Direct answer
After credential exposure, use the provider's trusted account-recovery process to change affected credentials and review active sessions and recovery methods. Session invalidation behavior varies, so verify the provider's guidance and involve the account owner.
Secure the affected identity
Access the service using a known app or address, not a link from an unexpected notice. Change the affected and reused or similar passwords and enable multifactor authentication where supported. For workplace identities, contact the organization's security team.
Reference: FTC: Responding to a data breach notice.
Review existing access
Some services allow the owner to sign out other sessions or revoke tokens. Follow the provider's instructions and determine whether password change automatically invalidates sessions; do not assume all sessions or application tokens were revoked.
- Review recent sign-in activity and unfamiliar devices where available.
- Check recovery email and phone settings through the trusted service.
- Do not share session tokens or passwords in incident records.
Coordinate business dependencies
A service account or shared integration may use tokens that support legitimate workflows. Work with the identity owner to rotate and update these safely. An unmanaged global sign-out can interrupt operations without addressing every API credential.
Reference: NIST SP 800-61 Rev. 3: Incident Response.
Record and reassess
Keep the account, time, actions and unresolved sessions in the incident record. If logs suggest unauthorized activity, use the provider and organization's incident process. A clean activity view may be incomplete and is not proof that no access occurred.
Assessment limits
Session controls and logging differ by provider. A password change or session list cannot prove complete remediation of every device or credential.
Frequently asked questions
Does changing a password end every session?
Not always. Check the service's supported session and token revocation behavior.
Should I share a one-time code with support?
Do not share authentication codes in response to an unexpected request. Use the service's verified recovery process.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.