Rotate credentials when the breached company holds any secret of yours, such as a password, API key, token or signing key, or when you cannot rule that out. If you share nothing with them, rotation is not needed for this story. The FTC guide notes that stolen credentials stay useful to attackers until they are changed.
Step 1: list what you share
Write down every secret that exists on the other side. Typical items are user accounts, service account passwords, API keys, webhook secrets, OAuth app secrets, SSH keys uploaded to their service, and tokens stored in their integrations.
Include things you gave them years ago and forgot. Old access is a recurring theme in breach reports.
Step 2: check what was exposed
Read the notice. If it says passwords were stored hashed, that lowers risk but does not remove it, especially if passwords are weak or reused. If it says tokens or keys were accessed, treat them as exposed. If it says nothing about secrets, assume they may be involved and decide by how sensitive the access is.
Step 3: decide by sensitivity
A simple split works:
- Rotate now: production keys, signing keys, admin accounts, anything that can move money or read customer data.
- Rotate this week: staging keys, read only tokens, shared team accounts.
- Review: accounts that exist but hold little power.
Step 4: rotate in a safe order
Create the new secret first, deploy it, confirm things work, then revoke the old one. Revoking first causes outages and makes people tempted to skip the next rotation.
Step 5: look for misuse
Check the audit logs of the services those secrets protect. Look for use from unfamiliar places or at odd times, from before and after the news date. Keep notes of what you checked.
Step 6: fix the habit
If the rotation was painful, that tells you something. Credentials that are hard to rotate tend to live forever. Moving to short lived tokens and a central secrets store makes the next story a routine change.
Tell your own users when it matters
If their data or access could be affected, follow your legal duties and the guidance on notifying affected parties. The FTC guide suggests being accurate and sharing details that help people protect themselves.
Quick check
Is a hashed password database safe?
It is safer than plain text, but weak or reused passwords can still be recovered. Ask users to change reused passwords.
How often should I rotate keys without a breach?
Choose a schedule your team can actually keep, and make rotation a tested routine so it is quick when you need it.
Sources
Last reviewed: 19 October 2026.
