I changed my password after a breach. Am I safe now?

Maybe not. Changing your password after a breach closes one door, but if the attacker stole your session cookie, planted malware, kept an app you once connected, or you reuse that password elsewhere, they can still get in. A reset is one step, not the whole fix. SpyCloud recaptured roughly 17 billion stolen session cookies in 2024, the exact thing a password change does not touch.

I changed my password. Am I actually safe now?

Not necessarily. A password reset only cancels one secret, and a modern breach usually hands the attacker more than that. Stolen credentials are the single most common way intruders get in, used in 22% of breaches (Verizon 2025 DBIR). If that credential came from malware on your device, the malware took your logged-in sessions too.

The reset feels final because it's the one button you can press yourself. That's the trap. It shuts the door the attacker may not even be using, while the door they are using can stay wide open. Whether you're actually safe depends on how you were breached and on a handful of things a password change simply doesn't reach.

Here's the honest short version: if a website you used leaked a password database, a reset plus turning on MFA is usually enough. If your own device was infected, or the attacker already got inside your account, a reset by itself is not enough. The rest of this guide walks the cases where risk stays, then the order to fix them in.

Why is someone still logged into my account after I reset my password?

Because a login session is a separate key from your password. When you sign in, the site hands your browser a session cookie that says this device is already logged in. That cookie has its own lifetime and keeps working until it expires or you explicitly sign out everywhere. SpyCloud recaptured roughly 17 billion stolen cookies in 2024 (SpyCloud 2025).

So if an attacker copied that cookie, they can replay it and land straight inside your account, skipping the password box and the MFA code entirely. Changing the password does nothing to the cookie, because the cookie was issued before you reset. This is the single most misunderstood point after a breach: resetting your password and signing out all sessions are two different actions.

What did the breach actually take besides my password?

If your device was infected with an infostealer, a lot. This kind of malware sweeps everything a browser saves in one pass. SpyCloud found each infection grabs an average of 1,861 session cookies and 44 saved logins (SpyCloud 2025). The single password you reset is one item on a long list. A typical haul from one device includes:

• Every password saved in your browser, paired with the exact site it opens
• Active login sessions (cookies) for email, banking, social and shopping accounts
• Autofill data: your name, address, phone and saved card details
• Access tokens for apps and services you signed into, which can outlive a password change
• On a work or developer machine, API keys and stored secrets

That's the difference between a leaked website database and a compromised device. A leaked database usually exposes one login. An infected device exposes your whole saved-password vault at once, which is why the right response is bigger than resetting the one account you noticed.

Does resetting my password sign out the apps I connected?

A single infostealer infection lifts roughly 1,861 session cookies, and a reset clears none of them (SpyCloud). Usually not, and this is an easy one to miss. When you click Sign in with Google or connect a third-party app, you authorize a long-lived access token that lives outside your password. Changing the password does not automatically revoke those grants. Microsoft's own documentation shows why: killing refresh tokens and browser session cookies is a separate, deliberate revoke action, not a side effect of a password change (Microsoft Learn).

So after a breach, open the security settings of the affected account and review connected apps and active devices. Remove anything you don't recognize, and use the sign out of all sessions option if it exists. That single click is what actually kills a stolen cookie and any lingering app token, which a password reset leaves alone.

I use this password on other sites. Does that still matter?

Yes, a lot. If you reuse the breached password anywhere else, the attacker can take the leaked pair and try it across popular sites, a tactic called credential stuffing. SpyCloud found 70% of people exposed in breaches reused the same password across accounts (SpyCloud 2025). Resetting one account leaves the same key working on all the others.

Small tweaks don't save you either. Turning Summer2024 into Summer2025 is exactly the variation attackers test first. If you changed the breached password to something similar, or you still use the old one anywhere, treat every account that shared it as also breached and give each a unique password.

So what should I actually do, in order?

Order matters, because each step protects the next. Do them out of sequence and you undo your own work: rotate passwords on a still-infected device and the malware just steals the new ones. IBM X-Force logged an 84% jump in emails delivering this malware in 2024, so this is a common cleanup, not a rare one (IBM X-Force 2025).

• Clean the device first. Run a full scan with reputable antivirus, or if you suspect an infostealer, back up your files and reset the device. Rotating passwords on an infected machine just hands the new ones straight back.
• Sign out of all sessions. In the account's security settings, use sign out everywhere and remove connected apps and unknown devices. This is what actually kills a stolen cookie.
• Change the password to a new, unique one. A password manager makes this painless and stops you reusing it.
• Check for reuse. Update every other account that shared that password or a close variation of it, starting with your email, since email resets everything else.
• Turn on MFA, preferably an authenticator app or a passkey rather than SMS, so a future stolen password alone is not enough.

How do I know if I'm still exposed?

You check whether your accounts are sitting in stolen data, not just whether you changed a password. Stolen credentials fuel the top breach path, used in 22% of cases, and they can keep circulating for years after the original leak (Verizon 2025 DBIR). Speed matters too: attackers linger a median of 11 days once inside (Mandiant M-Trends 2025).

For an individual, that means using a reputable breach-check service, turning on login alerts, and watching your email for reset messages you didn't request. For an organization worried its people, staff or customers are exposed in stealer logs, Ashetrace surfaces which identities on a domain are sitting in stolen data and what's still live, so you can revoke and reset against a real list instead of guessing. You verify a domain you control, and no passwords, cookies or tokens ever change hands.

The takeaway is simple. Changing your password is a good first move, and sometimes it's enough. But if your device was infected or the attacker was already inside, the reset is step three of five. Assume you're still exposed until you've cleaned the device, signed out every session, and closed the reused passwords behind it.