How to Check if Your Email Was in a Data Breach (and What to Do)

Almost everyone’s email address has appeared in at least one data breach. That is not a reason to panic, but it is a reason to check, because stolen passwords are one of the most common ways accounts get taken over.

Step 1: Check your email address

1. Go to haveibeenpwned.com, a free service run by security researcher Troy Hunt.
2. Type your email address and press the search button.
3. You will see either a green “no pwnage found” message, or a list of breaches with the date, the company and the types of data exposed.

Check every email address you have used, including old ones. You can also subscribe to notifications so you are told when an address appears in a new breach.

Step 2: Understand what was exposed

Each breach lists the data types. The most important to look for:

• Passwords. The most serious, especially if you reused that password.
• Phone numbers and addresses. These make you a target for convincing scam calls and texts.
• Financial or government ID numbers. These call for extra steps, below.

Step 3: Change the passwords that matter

For each breached service, change the password immediately. Then work through any other accounts where you used the same password, starting with email, banking and shopping. Reusing a password is what turns one breach into many.

Step 4: Make it hard to repeat

• Use a password manager to create a long, unique password for every site. Your browser or phone’s built-in manager works if you do not want to install anything new.
• Turn on two-factor authentication for important accounts. See our guide to setting up two-factor authentication.
• Use your password manager’s security check. Chrome, Apple Passwords, Microsoft Edge and most third-party managers can flag reused or exposed passwords.

Step 5: Watch for follow-on scams

After a breach, criminals often send messages that use real details about you. Treat unexpected messages with suspicion, and read our guide to spotting phishing emails and texts.

If sensitive details were exposed

• Card number: tell your bank or card issuer and ask for a replacement card.
• Government ID or financial account numbers: consider a credit freeze. In the US, our guide to freezing your credit walks you through it.
• Phone number: be wary of calls or texts, and ask your carrier about extra protection against SIM-swap fraud.

A note on “breach checker” lookalikes

Only enter your email address on sites you trust, and never enter your password into a breach checker. Fake “check if you were hacked” pages are themselves a common scam.