How to Check If Your Email Was in a Data Breach (and What to Do Next)
A breach notification rarely arrives with drama. It shows up as a bland email, often months after the fact, telling you that your address appeared in some database you don't remember signing up for. There's no instruction manual attached, and the company that leaked your data usually isn't the one you need to call. So most people read it, feel a flicker of unease, and close the tab.
That flicker is worth following up on. Ten minutes of checking and a handful of password changes will do more for your security than any alarm or subscription. Here's how to find out what actually leaked, and what to do about it.
What a breach checker can and cannot tell you
Breach-check services work by matching your email address against collections of stolen data that have surfaced publicly. Type in an address and you'll usually get a list: which site was breached, roughly when, and which categories of data were exposed — email addresses, passwords, usernames, phone numbers, physical addresses, payment details.
Have I Been Pwned is the best-known of these and is free to search. Firefox Monitor draws on similar data, and if you use Chrome, Android, or an iPhone, your browser or password manager probably already warns you when a saved login shows up in a known leak. Those built-in warnings are easy to miss, but they're genuinely useful.
What these tools can't tell you is whether someone is actively using your credentials right now, whether the leaked password was stored in plain text or as a hash, or whether you were singled out. They also only see breaches that became public. Plenty never do. A clean result is reassuring, not a guarantee.
How to run a check properly
- Type the address yourself. Never click a link in an email claiming to alert you about a breach. Those messages are a favourite phishing lure, and the fake sites look convincing.
- Search every address you own, not just your main one. Old accounts from a decade ago still matter if you reused that password anywhere.
- Read the details, not just the headline. A breach that exposed only email addresses is annoying. One that exposed email plus password is a different problem entirely.
- Check your password manager's security report. Most include a section listing reused passwords and passwords found in leaks, tied to the specific accounts you have saved.
Turning results into priorities
Not every breach deserves the same reaction. A dump from a long-dead forum where you used a throwaway password is close to harmless. A leak from last month that included your email and a password you also use for online banking is urgent.
The real danger isn't the breach itself — it's credential stuffing. Attackers take leaked email-and-password pairs and try them automatically across hundreds of other services. If you reused that password, one old forum leak becomes a login to your email, your shopping accounts, or your cloud storage. That's why the fix isn't just changing the password on the breached site. It's changing it everywhere it appears.
Change them in this order
Start with your email account. It's the master key: whoever controls your inbox can reset passwords on almost everything else. Then work outward — banking and payment accounts, government and tax portals, cloud storage, social media, shopping. For each one, set a long, unique password. A passphrase of four or five unrelated words is easier to remember and harder to crack than a short jumble of symbols.
If the idea of tracking dozens of unique passwords sounds exhausting, that's the argument for a password manager. You remember one strong passphrase; it remembers everything else and fills in logins as you go. Any reputable manager is better than reuse.
Then check the accounts you forgot
Breach reports often reveal accounts you no longer use. Delete them where you can. A dormant account with an old password is a liability you get nothing from.
Turn on two-factor authentication
Even a perfect password can be stolen through a convincing fake login page. Two-factor authentication closes most of that gap by requiring a second proof that you're you. Turn it on at least for email, banking, and any account that stores documents or payment cards.
- Authenticator app or passkey: the strongest common option; the code lives on your device, not in a text message.
- Hardware security key: a small physical device you tap or insert. Excellent for email and other high-value accounts.
- SMS codes: better than nothing, but vulnerable to SIM-swap attacks. Use it only if nothing better is offered.
Wherever you enable it, save the backup codes somewhere offline — printed, or in a secure note — because losing your phone without them can lock you out permanently. While you're in the settings, look for a list of active sessions or connected apps and revoke anything you don't recognise. Old app passwords and forgotten devices are quietly common ways back in.
The slower cleanup
Expect phishing that references the real leak. If your address, employer, and phone number appeared together, a message can look surprisingly credible. Treat unexpected urgency — a locked account, a failed payment, a delivery — as a reason to slow down, and reach the company through a site or number you already trust rather than a link in the message.
If payment card details were exposed, contact your bank or card issuer and ask what they recommend; they deal with this constantly. Where identity theft is a risk, many countries let you place a freeze or fraud alert with the major credit bureaus, though the rules differ by country, so check what applies where you live. If money, tax records, or legal exposure are involved, it's worth speaking to your bank and, where relevant, a professional who knows your local rules.
Going forward, consider giving each service its own email alias rather than your primary address. Several providers and browsers offer this. It keeps your main inbox out of future dumps and makes it obvious who sold or leaked your data.
Your ten-minute version
If you do nothing else today, do this. Search your main email address on a breach-check site. Change the password on your email account, then on any account where you used that same password. Turn on two-factor authentication for email and banking. Save the backup codes. Then set a reminder to repeat this once or twice a year, or whenever a notification lands.
None of it is glamorous, and none of it takes long. Breaches will keep happening; the goal isn't to avoid every one. It's to make sure that when your data turns up in someone else's file, it isn't the key to everything you own.
Photo: Burst / Pexels
