Browsers & Accounts · Passwords, Passkeys & Two-Step · Lesson 5 of 5

Challenge: The Leaked Login

A breach alert says your email and password are online. Put your plan in order.

The alert pops up

You're making dinner when Chrome shows a warning. The email address and password you use on a shopping site were found in a data breach.

Then your stomach drops. Years ago you used that same password for your email account. Maybe for a few old accounts too.

First question: is the alert real? It appeared inside your browser's own password manager, not in an email with a link. You open Password Checkup yourself to confirm, without tapping any link. The shopping site is listed as compromised.

Take a breath. A leaked password is a problem you can fix tonight, one account at a time.

Now you need an order. Here's your list: the shopping site that leaked, your email account (same password), your bank (a different password, thankfully) and a handful of old accounts that share the leaked one.

Locking down the inbox

You go to your email provider's site by typing the address yourself. You change the password, letting your manager's generator make a new one. Then you open the security settings to add a second step.

Three options appear: text message codes, an authenticator app, or a passkey. While you're there, you notice the recovery phone is a number you gave up years ago, so you update it too.

The 2 a.m. prompt

A week later, your phone buzzes at 2 a.m. "Are you trying to sign in?" It's from one of the old accounts you haven't fixed yet, which uses push approvals. You didn't start any sign-in. It buzzes again, and again, and again.

You remember what this course said about prompts you didn't start. Someone out there has the old leaked password and is hoping you'll tap Approve while you're half asleep.

You tap Deny each time. In the morning, you change that account's password and check its recent sign-in activity.

Tidying up

On the weekend you finish the job. You give each old account its own generated password, so none of them share the leaked one anymore.

You also run the checkup one more time. The breach warning is gone, and the reused list is much shorter.

Then your sister asks for the new streaming service password, since the old one stopped working for her. In the past you just texted passwords to her, and those old texts are still sitting in both your phones.