A leaked password needs replacing wherever you reused it. First verify the warning through the service or password manager itself, then secure the affected accounts. A breach alert is not proof that someone signed in, but it is a reason to stop trusting that password.
For a Google Password Manager warning, Google recommends going directly to Password Checkup to confirm the alert. In Chrome, open Passwords and autofill → Google Password Manager → Checkup. Other password managers have their own security review. Do not enter a password into an unfamiliar “leak checker” advertised by a message.
Decide which account comes first
If the exposed password also protects your email account, secure email first: it may control password resets elsewhere. If you are already seeing unauthorized purchases or account changes, treat this as an account takeover rather than a password-only cleanup and contact the affected provider promptly.
If a device may be infected, use another trusted device for the account changes and address the suspected infection. Google’s compromised-account guidance includes checking devices, removing harmful software, reviewing suspicious activity, and investigating unauthorized financial activity. Changing a password is not a substitute for that wider response.
Replace the credential, then inspect access
1. Change it at the actual service. Open the official app or a known bookmark. Generate a new, unique password with your password manager, save it, and submit the change. Editing the saved entry alone does not change the service’s password. Google’s guidance recommends unique passwords because reuse increases the risk across accounts.
2. Review recovery and sign-in methods. Check that recovery details still belong to you. Review unfamiliar authentication methods and connected apps through the provider’s security settings. If you cannot sign in or an attacker changed recovery details, start the provider’s official recovery process. For an organization-managed account, involve its administrator rather than improvising around its controls.
3. Review existing sessions. Use the account’s device/session list and sign-out controls where provided. Do not assume a password change ends every connection. Google documents exceptions, including some identity-verification devices and devices with third-party app access. Review those connections separately.
4. Check what the account can still do. For email, inspect forwarding and filters for changes you did not make. For accounts that can spend money, inspect recent transactions. Google’s compromised-account instructions cover both. Report unfamiliar activity through the service’s own support or dispute process; do not reply to a suspicious notification.
Work outward without resetting everything blindly
Hypothetical example: A shopping password was also used for email and a streaming service. Replace all three with different passwords. An unrelated account with its own unique password is not automatically exposed by that reuse.
There is an important exception: if the email account or the account holding saved passwords was actually accessed, the problem may extend beyond reused credentials. Google’s takeover guidance calls for broader changes, including accounts linked through that email and passwords saved there. Follow the provider’s incident instructions rather than treating “unique password” as proof of safety.
Enable two-step verification on supported accounts and retain a usable recovery method. It adds protection against a stolen password, but does not undo changes already made or remove existing sessions by itself.
Confirm the cleanup
Keep your trusted session open while confirming the new password works in a separate sign-in. Revisit recovery settings and the device list after saving changes. Keep a private checklist of affected accounts, password changes, access reviews, and unresolved activity, never the passwords themselves.
A quiet activity log cannot prove that nothing was copied. Confirm what the cleanup can establish: new credentials work, reused credentials are replaced, unexplained access is addressed, and any financial or account damage has its own follow-up.