The old secret stops working and a new one takes its place. It limits how long a stolen credential is useful, and it is a standard step after a suspected breach, an employee leaving or a secret being exposed in code or logs.
The difficult part is finding everything. Credentials sit in configuration files, scripts, CI/CD systems, password managers and other services, and rotating one without updating the places that use it causes outages. A secret that was stored in a file the attacker could read must be assumed to be known.
In January 2023, CircleCI told customers to rotate all their secrets after a breach of its systems, since stored tokens and keys could have been taken.
Keep a list of where each secret is used, store them in a secrets manager and not in files, automate rotation where you can, and after a compromise rotate in order of power, starting with administrator and service accounts.