Australians are being urged to secure their social media accounts after the details of more than 500 million global Facebook users were found online in a massive data breach.

The details published freely online included names, phone numbers, email addresses, account IDs and bios.

In a statement, Facebook said the leaked information was old, and came from a problem it had resolved in 2019, but experts told Guardian Australia the data could still cause problems for users caught up in the breach.

So what might hackers do with your info? How can you check if your data was leaked? And what can you do to protect yourself?

How your information could be used

Dr Andrew Quodling, a researcher in governance of social media platforms at the Queensland University of Technology, said that the data could be used to gain access to people’s Facebook accounts but also emails and accounts with other social media sites.

Once a hacker has your email, they can try to login into your accounts by pairing your email with simple passwords.

“People will take a sort of an easy run at simple hacks – try the top 100 most common passwords, and try to get in with brute force,” he said. “So anyone using the password 123 on that list would be in trouble.”

How to find out if your data was leaked

The quickest and easiest way to find out if your data has been leaked as part of a wider breach is to check on websites run by security researchers.

One of the most popular and effective of these sites is HaveIBeenPwned.com, a database maintained by security analyst Troy Hunt.

It only needs your email, which it cross-references with more than 10bn accounts that have been breached in the past to find if your details were leaked online.

It also has an option, for users to check if their password has been compromised.

Unfortunately, it does not yet track phone numbers, which were the most common user field in the recent Facebook leak.

What to do if your data was breached

In any data breach, it’s important to ensure identity documents, such as driver’s licence and passport details, haven’t been compromised. If they have, replace them immediately.

If your email address was exposed, change your password for that account, and set up two-factor authentication where possible.

To protect yourself in future, use a password manager – such as 1password, LastPass or Keeper. These are paid services which can generate long and difficult passwords for your accounts, and store them for you so you don’t have to remember them.

But Dr Quodling warns that there is only so much users can do to prevent their data being used, apart from just quitting the social media platforms altogether.

“You could be profoundly security conscious and secure, and still get caught out by insufficient security practices at other organisations you rely on,” he said.

“The challenge is always how much of a risk are you personally willing to take?”