Protection — self-defense by level

Email-password pairs are what most breaches expose. Reuse the same pair and one leak becomes unauthorized logins everywhere (credential stuffing).

Let a password manager generate a strong, unique password per service; memorize only the manager's own passphrase. Even the browser's built-in manager is effective.

Even with a leaked password, a second factor — an authenticator app or hardware key — blocks nearly all account takeovers. Authenticator apps (Google Authenticator etc.) and FIDO2/passkeys are safer than SMS codes.

Enable it on your most important accounts (email, finance, social) first. Email is the "last fortress" that receives password resets for everything else — start there.

Most attacks hit known vulnerabilities. Auto-updating your OS, browser, and phone apps keeps the known holes plugged.

After a breach, phishing surges pretending to be the "change your password" notice. Never log in from links in email or SMS — open the official site or app yourself.

Urgent wording ("within 24 hours...") and trusting the sender display alone are mistakes. When unsure, contact the company's official support channel.

Have I Been Pwned tells you if your email appeared in past breaches. For Japanese incidents, search this site's breach database by company name and data type.

Prioritize changing passwords for the affected service and for every service where you reused it.

Separate addresses for logins, receiving, and throwaway signups limit the scope of any leak and make it easier to identify which service leaked.

iCloud's Hide My Email or alias services like SimpleLogin let you register with a distinct address per service.

FIDO2/passkeys are phishing-resistant — the strongest form, removing the password itself. Set them up wherever offered.

For your most-targeted accounts (main email, social, finance), register a hardware key like a YubiKey as backup so device changes or loss don't lock you out.

Prefer virtual cards (with limits and merchant restrictions), convenience-store payment, or carrier billing over giving real card numbers to online shops.

If a card-data breach is disclosed, contact your card issuer about reissue and set up transaction alerts.

After enabling MFA, store backup codes somewhere safe (password manager, or paper in a safe). Stale recovery emails and phone numbers mean you can't recover when it matters.

Dormant registrations are inventory for future leaks. Delete what you can; for services you can't leave, switch the email to a throwaway address.

Don't maximize everything: match controls to the assets you protect (money, reputation, privacy) and the realistic adversary (indiscriminate automation vs. targeted). NCSC's Small Business Guide offers a framework individuals can borrow.

Filtering DNS like NextDNS or Quad9 blocks connections to malicious and phishing domains at the device level — and works for the whole family's devices.

Keep main email and finance in a dedicated address and browser profile (or device) never used for everyday signups. If the everyday side gets contaminated, the critical side stays unreachable.

With HTTPS everywhere, eavesdropping on public Wi-Fi is less of a risk than it was. Higher priorities: never bypass certificate warnings, and avoid financial operations on public networks. A VPN still makes sense for geo-restrictions or link encryption.

3 copies, 2 media, 1 off-site. Recovering from ransomware or accidental deletion is fastest with your own backups — faster than insurance or vendors.