Start with the account that controls recovery
Your email account may receive password-reset links for several services. Use its established official sign-in route from a trusted device. Check the recovery methods and any available security activity before changing the exposed password to a unique one.
Where supported, enable an additional authentication factor and retain the provider's recovery method. Do not assume IPTV Canada or a particular player offers the same controls. Email, player licences and television-service credentials can belong to different operators, each with its own recovery process.
Replace reuse without creating another shared secret
Give every affected account a different password or passphrase. A password manager can generate and retain separate entries, but protect the manager itself and keep its recovery arrangement understood. Renaming one reused password by adding “TV” or the current year is a weak way to separate accounts.
Keep a private checklist of which account was changed and when. The checklist needs a service name and completion state, not a column containing every new password. Verify the correct domain before saving a replacement entry so a fraudulent page does not become the new stored destination.
Ask what existing access remains valid
A password change may not end every existing session or revoke every media link. Check the actual service's controls for signing out sessions or replacing access credentials. If those controls are not visible, ask the operator what action invalidates the affected access.
An illustrative case is a customer changing an email password while an old television-service playlist remains usable through its separate token. The email correction is still valuable, but it does not prove that the playlist exposure was contained. Keep the two authorization systems separate.
Retest normal viewing after containment
Update only the affected approved account entry in the intended player. Preserve non-sensitive favourites and configuration notes. Make one normal playback attempt and record the outcome; repeated sign-in attempts during a security recovery can create an avoidable lockout or rate-limit question.
If an unexpected message asks for the new password, do not reply with it. Return to the established support route and use a private order reference where appropriate. A useful final record says which accounts were secured, which sessions were revoked and which questions remain unanswered. It should not claim that deleting a suspicious message erased copies of a leaked secret.
Related questions
Must I change unrelated passwords that were already unique?
A reused-password incident does not by itself prove those separate secrets were exposed. Review actual access evidence and secure the recovery accounts that control them.
Sources and scope
Scope notes distinguish published documentation, supplied information and editorial methods. They do not report a hands-on service test.
- Canadian Centre for Cyber Security: Best practices for passphrases and passwords — Unique account credentials and authentication hygiene; no claim that a specific player supports a feature.
- Canadian Centre for Cyber Security: Password managers security tips — Password-manager selection and recovery principles.
