How to Check If Your Email Was in a Data Breach, and What to Do Next

Last updated: November 5, 2026 · Steps checked against Have I Been Pwned and the FTC's IdentityTheft.gov (sources at the bottom)

We may earn a commission if you buy through links here — it never changes our picks.

A data breach is an incident where a company's stored information gets exposed to people who should never have seen it, usually because of weak access controls or a flaw in the software. Names, email addresses, passwords, phone numbers, sometimes far worse. The data then circulates among scammers and gets traded for years afterward.

The free service this guide uses is Have I Been Pwned (haveibeenpwned.com), a breach lookup site run by security researcher Troy Hunt. It collects data from known breaches, loads the exposed email addresses into a searchable index, and lets anyone ask one question for free: has this address been seen in a breach? As of this writing it covers more than a thousand breached websites and billions of exposed accounts. ("Pwned" is old gaming slang for "owned," as in defeated. If the site says you were pwned, your address was in the pile.)

The check takes two minutes. Knowing what the answer means, and what to do about it, takes a little longer. That is the rest of this guide.

Before you start

What you need

Every email address you use or have used. Most people have more than one: a current address, an old one from years ago, maybe a work address. Breaches do not care which one is your favorite. Check them all.
Ten quiet minutes. Two for the check itself, the rest only if something turns up.
Your password manager, if you have one. Most fixes below end at "change the password," and a manager makes that fast. If you do not have one yet, our password manager setup guide is the place to start.

The two-minute check

Go to the real site, by typing it yourself

Type haveibeenpwned.com into your browser's address bar. Do not follow a link from an email or text message claiming your account was breached. That exact scare is a common phishing trick, and fake breach-check sites exist to harvest the addresses people type in. Typing the address yourself takes five seconds and removes the whole category of risk.

Enter your email address and run the search

The homepage is one search box. Enter your email address and press the button. That is the whole interface. For reassurance, the site's own FAQ states that searches are not logged and addresses are not collected, and that when breach data is loaded into the service, no passwords are loaded alongside the email addresses. You are asking about an address, not handing over credentials.

Read the result

There are two basic outcomes. A clean result reads "Good news — no pwnage found!" and means the address was not in any breach loaded into the service. A hit reads "Oh no — pwned!" and lists what it found, in two sections:

Data Breaches: one entry per breach the address appeared in. Each entry names the service, describes what happened and when, and lists the compromised data, the types of information that were exposed.
Paste Records: times the address turned up in a "paste," a chunk of data posted to a public text-sharing site such as Pastebin. Pastes are often where breach data first surfaces. The site records that your address appeared and when, but it does not store the paste itself.

You should now see: either a clean result, or a list you can work through item by item.

Repeat for your other addresses

Run the old address, the work address, the one you only use for shopping. Old addresses are the usual surprise, because they were signed up to more sites over more years, including sites that no longer exist.

Reading the result: the data types are the story

Two people can both be "pwned" and be in completely different situations. What matters is the Compromised data line on each breach entry. Read it before you react:

Email address only (sometimes with a username or name). The lowest-risk hit. Nobody can sign in as you with just an address. Expect more spam and more convincing phishing, because scammers now know the address is real and, from the breach name, which services you used.
Passwords. Serious, and time-sensitive. It does not matter much that the passwords were stored scrambled (you will see words like "hashed" in breach write-ups). Attackers work through scrambled password lists in bulk, and the weak ones fall quickly. Treat any breach that lists passwords as: the password for that account is public until you change it.
Phone number, home address, date of birth. These cannot be changed like a password, and they are the raw materials for impersonation: convincing scam calls, attempts to move your phone number to a scammer's SIM, and security questions answered on your behalf.
Financial data or Social Security number. The rare, heavy end of the scale. Credit card numbers mean watching statements and possibly replacing the card. A Social Security number means the credit steps later in this guide, because it can be used to open accounts in your name.

You may also see labels on some entries. A breach flagged sensitive (a site whose membership is private by nature) is hidden from the public search and only shows if you verify the address is yours through the site's notification signup. A breach flagged unverified means the data looks real but its origin could not be fully confirmed. Neither label changes your response much: work the list in front of you.

A clean result is good news, not a guarantee

If the check comes back clean, enjoy it, and understand its limits. The site says this about itself, plainly: it holds only a small subset of all the records that have ever been breached. Many breaches are never made public, and some are never even detected. In the site's own words, "absence of evidence is not evidence of absence."

Practically, that means three things. A breach can exist that the service has not loaded yet, or never will. Stolen login lists also circulate privately (attackers call a bulk try of leaked email and password pairs credential stuffing) without ever becoming a named breach you can search. And a clean result today says nothing about next year. So treat the check as a smoke alarm, not a clean bill of health: run it now, sign up for the free notifications below, and keep the password habits that make any single breach a small event.

You got a hit. Do these, in this order

Change the password on the breached account

Go to the service named in the breach entry, by typing its address yourself, sign in, and change the password. The FTC's advice on this page is direct: log in and change your password, change your username too if the service allows it, and make the new password long and strong. If the account is one you no longer use, consider closing it instead. A closed account has nothing left to steal.

Change it everywhere you reused it

This is the step people skip, and it is the one that matters most. If the breached password is the same password, or a close cousin of it, on other accounts, those accounts are exposed too. Attackers take leaked email and password pairs and try them automatically across hundreds of sites. That is the credential stuffing defined above, and it works because reuse is so common. Find every account that shared the password and give each one its own fresh password. A password manager is what makes "a different password for every account" realistic instead of a slogan. It also remembers them, so unique stops meaning forgotten.

Not sure whether a password of yours has been seen in a breach? The same service has a separate checker, Pwned Passwords, on its site. It is built so the password itself is never sent: only part of its scrambled fingerprint is compared. A password that shows up there should never be used again, anywhere.

Turn on the second layer: 2FA or passkeys

While you are in that account's security settings, turn on two-factor authentication (2FA, a second proof at sign-in, usually a code from an app on your phone) if it is not already on. Better still, if the service offers passkeys, turn those on: a passkey replaces the password with a fingerprint, face, or PIN check on your own device, and there is no password for a breach to leak in the first place. Our passkeys guide walks through the setup for Google, Apple, and Microsoft accounts, and our 2FA codes guide covers managing authenticator codes when you change phones or apps.

Expect phishing that knows things about you

After a breach, the follow-up scam is the quiet part of the damage. The leaked details make fake messages convincing: the right name, the right service, sometimes the right last purchase. Treat any unexpected email, text, or call that references the breached service as suspect, especially ones pushing urgency ("verify now or lose your account"). Do not use the links or phone numbers in the message. Go to the service the way you always do, by typing its address or opening its app, and check there. The FTC gives the same advice for breach follow-ups: contact companies using a website or number you already know is real, never the one supplied by the message.

Sign up for notifications so the next one finds you

On the Have I Been Pwned site, open Notify me (linked from the homepage as breach notifications), enter your address, and click the verification link the service emails you. From then on, if that address appears in a newly loaded breach, you get an email about it instead of finding out by accident. It is free, and the service states it never shares your email with anyone else. Do this for each address you checked. Five minutes now buys you an early warning for every future breach on that list.

If a Social Security number or financial data was exposed

Most email breaches end at the steps above. The heavier playbook below is only for the heavy hits: a breach whose compromised data includes a Social Security number, bank or card details, or if you spot accounts or charges that are not yours. The FTC's hub for all of this is IdentityTheft.gov, and its sequence is:

Check your credit reports. Get them free from AnnualCreditReport.com, the site the FTC points to. You can check your reports online every week for free. Look for accounts, loans, or debts you do not recognize. If you find one, contact that company, and report the misuse at IdentityTheft.gov to get a personal recovery plan.
Freeze your credit. A credit freeze blocks anyone from opening a new credit account in your name, because lenders cannot pull your credit report while it is frozen. The FTC is clear that a freeze is free to place and free to lift, and it stays until you remove it. The catch is that you must place it with each of the three credit bureaus: Equifax (800-685-1111), Experian (888-397-3742), and TransUnion (888-909-8872). A freeze does not affect your existing cards or accounts, and you can lift it temporarily when you apply for credit yourself.
Or place a fraud alert. A fraud alert is the lighter option. It tells businesses to verify your identity before opening a new account. It is also free, an initial alert lasts one year, and you only contact one bureau, which is required to tell the other two.
Take free credit monitoring if the breached company offers it. Companies often offer this after a serious breach. The FTC's advice is to accept it. It watches your credit reports and flags new activity, and it costs you nothing.
Watch financial statements. If card or bank numbers were exposed, contact the bank or card company, ask about cancelling and replacing the card, and review transactions for charges you do not recognize.

Keep the proportion in mind. An email-only breach does not need a credit freeze. A Social Security number does. Match the response to the data, not to the anxiety.

Breaches are not the only place your details live

One more exposure, separate from breaches, is worth knowing about. Data brokers are companies that collect personal details (name, home address, phone number, relatives, and more) from public records and other sources, then sell or publish them. People-search sites are the public face of that trade: type in a name and up comes an address history. Your details can be listed there without any breach ever happening, simply because the records exist.

Getting removed is unglamorous. Each site has its own opt-out process, usually a form asking you to find your listing and request removal, and there are many sites. Doing it by hand is free but slow, and listings can reappear as brokers refresh their data. Paid removal services exist to automate the same work: they submit opt-out requests across many brokers and repeat them over time. One such service is Incogni. Whichever route you take, removal reduces how easily your details can be found. It does not erase public records themselves, and no service can promise that. Think of it as taking your name off the easy lists, not becoming invisible.

Common mistakes

Checking one address and stopping. The breach usually finds the address you forgot about. Check every address you have ever used for signups.
Changing the password on the breached site only. If that password lived anywhere else, the job is half done, and credential stuffing targets exactly the other half.
Panicking over an email-only hit, or shrugging at a password hit. The Compromised data line tells you which situation you are in. Match your response to it.
Reading a clean result as a permanent all-clear. The service covers a subset of breaches, by its own admission. Notifications plus unique passwords are what cover the rest.
Clicking the "you've been breached" email. Real breach news should send you to a site you type in yourself, not a link in the message that scared you.
Freezing credit for a minor hit, or skipping it for an SSN hit. Both the overreaction and the underreaction miss. The data type decides.

The whole job, as a checklist

Summary

Type haveibeenpwned.com yourself, and check every email address you use, including old ones.
Read the Compromised data line on each hit. Email only is low risk. Passwords are urgent. A Social Security number is the heavy case.
A clean result is good news with limits: the service holds only a subset of all breaches.
For each hit: change that account's password, then change it everywhere it was reused. Unique passwords, kept in a password manager, end the reuse problem.
Turn on 2FA or passkeys on the accounts that matter, starting with email and money.
Expect phishing that uses the leaked details. Never follow links in breach scare messages.
Sign up for the site's free Notify me alerts for each address you checked.
Only if financial data or a Social Security number was exposed: check your credit reports at AnnualCreditReport.com, freeze your credit free at all three bureaus, and use IdentityTheft.gov if you find actual misuse.
Separately, your details may sit on people-search and data-broker sites with no breach involved. Opt out by hand, or use a removal service such as Incogni.

Where these steps come from

The check itself and the claims about what it can and cannot see were checked against Have I Been Pwned's own pages. The response steps follow the FTC's breach guidance. All checked in November 2026.