Most people find out their address is in a leaked database months after the fact, from a news headline rather than their own bank. The good news is that you can check in about five minutes, and the steps you take afterwards matter far more than the leak itself. This guide shows you how to check if your email was in a data breach, how to read the report properly, and what to change first so a leaked password never turns into a stolen account.
Check if your email was in a data breach
Start with a breach lookup service. Have I Been Pwned (haveibeenpwned.com) is the best known: type your address, and it lists every public breach that includes it, along with the type of data exposed — email only, password hash, phone number, physical address, or payment details. Firefox Monitor and Google’s dark web report inside Password Manager offer a similar check.
Do this for every address you actually use, not just the main one. Old accounts from a decade ago are the ones that leak quietly, and they are also the ones still tied to password resets on services you forgot you had.
Read the breach report before you panic
The details decide how urgent this is:
- Email address only — expect more spam and better-crafted phishing. No password change needed for that site.
- Password, hashed — weak or reused passwords can be cracked offline. Change it anywhere you reused it.
- Password, plain text — treat that password as public. Change it everywhere, today.
- Card or bank details — contact the issuer and ask for a replacement card rather than watching the statement.
A breach notice is not proof your account was accessed. It is proof that the ingredients for an attack are circulating.
Change the password the right way
Change the password on the breached service first, then on every account that shared it. A leaked password reused on your email inbox is the real emergency: whoever controls your inbox can reset almost everything else.
Use a password manager to generate long random passwords, and let it remember them. If you have not set one up yet, our beginner password manager setup guide walks through the first hour, and an offline password vault covers the paper-and-USB fallback.
Turn on two-factor and fix your recovery options
Two-factor authentication turns a stolen password into a dead end. Prefer an authenticator app or a passkey over SMS, because SIM swaps defeat text codes. Then spend two minutes on recovery: is the backup email still one you can open? Is the phone number current? Attackers use stale recovery details to walk straight back in after you have cleaned up.
Google, Microsoft and Apple all show recent sign-ins in their security pages. Skim that list for devices and locations you do not recognise, and sign out anything unfamiliar.
Watch for follow-up phishing
The most common aftermath is a message that references the breach and offers “identity protection” through a link. Real breach notices do not ask you to log in from an email link. Open the service directly in your browser instead, and treat any message that creates urgency — account closing, refund pending, verification required — as hostile until proven otherwise. Our guide to spotting online shopping scams covers the same pressure tactics in a different disguise.
A five-minute monthly habit
Once a month, run the breach check again, review the sign-in list on your main email account, and confirm your two-factor codes still work. That small loop catches most account takeovers before they cost you anything, and it takes less time than resetting a single password under pressure.
For the documents and photos you could not replace, keep a copy offline: see protecting important documents before you need them.
Related reads
Sources: Have I Been Pwned, FTC data breach response guidance.