How you should address services flagged as compromised is independent of migration. Although it might feel like the right time to tidy things up, I would recommend separating the tasks. Migration tools don’t handle everything perfectly, so you will have some cleanup to do post-migration.
But once that it settled, the question is what to do about a large number of services you have passwords for that are listed as compromised since you created the password. It is an overwhelming task if you look at it as an all or nothing thing.
So I recommend spending no more than 10 minutes a day on it. Maybe if you get into a rhythm you can do more, but don’t “do it until you hate it” because then you won’t do it at all in coming days. Remember that each one you deal with improves your security to some degree. I do recommend some priorities.
- Reused passwords. If a password that you have for a compromised service is something that you have used for other services, you need to change to unique passwords for each of those services. You’ve been using a password manager, which is great, if you haven’t always used it to create unique passwords, then start with that. A password compromised from site X will be tried on site Y.
- Importance. Financial and email accounts are going to be the most important. Retail shopping will be next. Deal with those before dealing with others.
- Don’t worry about services that don’t exist any more. You only need to pay attention to them if you reused a password from such a service on something that does matter. So delete them after you’ve checked for reused passwords.
