Another week, another data breach notification in your inbox. This time it's Marquis (788,000 affected) and 700Credit (6 million affected), but it could be any of the dozens of breaches hitting consumers this year.
The standard advice is always the same: "Change your passwords." But let's be honest—when you have 100+ accounts, that advice is basically "spend your entire weekend clicking through password reset flows."
Here's a practical playbook that actually works.
The 5-step breach response checklist
Step 1: Secure your email first
Your email is the master key to everything else. Password resets, 2FA codes, account recovery—it all flows through email.
Do this now:
- Change your email password to something unique (16+ characters)
- Enable 2FA if you haven't already (hardware key > authenticator app > SMS)
- Check for any suspicious forwarding rules in your email settings
Step 2: Prioritize financial accounts
Banks, credit cards, investment accounts. These are what attackers actually want access to.
Priority order:
- Primary bank account
- Credit cards
- PayPal/Venmo/payment apps
- Investment accounts (Fidelity, Schwab, etc.)
- Cryptocurrency exchanges
Step 3: Rotate credentials at scale
This is where most people give up. Changing 50+ passwords manually takes hours.
Options:
- Manual: Block out 2-3 hours, go site by site (realistic: you'll do 10-20)
- Password manager bulk change: Some managers have limited "change password" features
- Automation tools: AI-powered agents can navigate sites and change passwords for you
For Mac users, there are now tools that automate the actual clicking—navigating to each site, finding the change password form, generating a new password, and updating it. The key is finding one that keeps credentials local (zero-knowledge) rather than sending your passwords to a cloud service.
Step 4: Enable 2FA everywhere possible
Even with a unique password, 2FA adds a critical second layer. After a breach, attackers will try credential stuffing—testing your leaked password across hundreds of sites.
2FA priority:
- Financial accounts (required)
- Email (required)
- Social media (high priority)
- Cloud storage (high priority)
- Shopping sites (medium priority)
Use an authenticator app (Authy, Google Authenticator, 1Password) rather than SMS when possible.
Step 5: Monitor and freeze
Immediate actions:
- Freeze your credit with all three bureaus (Equifax, Experian, TransUnion)
- Set up transaction alerts on all bank accounts
- Check haveibeenpwned.com for other exposures
- Consider identity monitoring for 6-12 months
The math problem with breach response
Here's why the "just change your passwords" advice fails:
- Average person has 100+ online accounts
- Average password change takes 3-5 minutes (find settings, verify identity, generate password, update manager)
- That's 5-8 hours of tedious work
78% of people reuse passwords. Attackers know this. When they get your credentials from one breach, they immediately test them everywhere—banks, email, social media, shopping sites.
The window between "breach disclosed" and "credentials tested" is shrinking. Automated tools now test stolen credentials within hours of a breach going public.
What actually works
The people who don't get compromised after breaches share a few traits:
- Unique passwords everywhere—No reuse, period
- Password manager—Makes unique passwords practical
- Regular rotation—Don't wait for breach notifications
- 2FA on everything—Especially email and financial accounts
The challenge is #3. Nobody has time to proactively rotate 100+ passwords. That's why automation matters—whether it's partial (password manager suggestions) or full (AI agents that actually execute the changes).
The local-first advantage
One thing to watch out for: some password change tools send your credentials through their cloud servers. That creates a new attack surface—now you're trusting a third party with all your passwords.
Look for tools that:
- Run entirely on your device
- Never transmit passwords to external servers
- Use local AI models or isolated API calls
- Give you full control over the process
December 2025 breach context
This month alone we've seen:
- Marquis Software Solutions: 788,000 people across 74 banks and credit unions. SSNs, account info, and financial records exposed via ransomware.
- 700Credit: 6 million people affected, including 160,000 in Michigan. Auto dealership credit data compromised.
- CNHI: Names and Social Security Numbers confirmed exposed.
Ransomware is now present in 44% of breaches (up from 32% in 2024). Third-party and supply chain compromises have doubled to 30% of all breaches.
The breach-to-exploitation window keeps shrinking. Don't wait.
About Dosel: We built a macOS app that automates password changes using local AI. The agent navigates each site and changes passwords for you, while keeping everything on your machine.
Download Dosel → — 5 free automated password changes per month, no credit card required.