Finding out your Instagram account was caught up in a data breach feels awful. You start wondering who has your email. Then you remember that old password you never got around to changing. The worry sticks around longer than it should.

The good news is that fixing the weak spots doesn’t take all afternoon. You don’t need to chase every scary headline either. Just lock the account down and move on.

Change the things that actually matter

Start with your password. Make it completely different from anything you’ve used before. If you reused that same password on another app, change it there too. 

Give yourself a backup

Turn on two factor authentication. Getting asked for a code feels slightly annoying at first. After a week you stop noticing it. And that extra step blocks a huge number of account takeovers.

• A fresh password that isn’t hiding in another account somewhere, because recycled passwords are usually the first thing attackers try

• Two factor authentication is worth the extra few seconds. You won’t miss the old routine.

• Recovery details matter too, especially if that backup email hasn’t been checked in ages

Take a slow look around your account

Open your login activity and see if anything looks unfamiliar. An old phone you forgot about is one thing. A device from a place you’ve never visited is another story. Sign out of sessions you don’t recognize and don’t overthink it.

Also check which outside apps have access to your Instagram. Some are useful. Others were connected years ago for one random feature and never touched again. If you don’t recognize one, remove it.

Don’t trust every message that lands in your inbox

Right after a breach, fake emails and direct messages tend to show up. They look convincing because they know people are already nervous. So don’t tap links just because they claim your account is at risk. Open Instagram yourself and check from inside the app instead. It feels slower for about ten seconds. Then you know you’re looking at the real thing.

• Strange login alerts deserve attention, but panic clicks usually make things worse

• If a message pushes you to act immediately, pause long enough to question it. Real security notices don’t need scare tactics.