Privacy & Security

Was Your Email in a Data Breach? How to Check and What to Do

By Inés Carrasco / November 11, 2026

Quick answer: You can check whether your email address turned up in a known data breach by typing it into a well-known breach-notification service such as Have I Been Pwned. It only needs your email address, never a password. If you are listed, do not panic: change the password for that account (and anywhere you reused it), turn on two-factor authentication, and watch for phishing emails that mention the breach. A credit freeze is worth considering mainly when more sensitive details, like a Social Security number, were exposed.

Key takeaways

Breach-checking sites compare your email address with lists of data from known breaches. Being found means a company you used was breached, not that you were personally hacked.
Only enter an email address. Never type a password, a bank detail or a Social Security number into a breach checker.
Fix your email account first, because password-reset links for your other accounts go there.
Reused passwords are the real danger: one leak can unlock many accounts.
A credit freeze is free and does not affect your credit score, so it is a sensible step when sensitive identity details were exposed.

What a data breach notification service actually does

When a company is hacked and its customer data leaks, copies of that data often get passed around online. Breach-notification services collect those leaked lists, pull out the email addresses, and let you search them. Think of it as a very large lost-and-found for email addresses.

Have I Been Pwned is the best-known example. Its own FAQ explains a couple of design choices that make it reasonable to trust. When addresses from a breach are loaded into the site, the matching passwords are not loaded with them, so a search tells you which breaches included your address and what kinds of data were involved, not your actual password. Its privacy policy says it does not collect or store personal information when you run a search.

The service also offers a notification sign-up. You enter your address, then confirm through a link sent to that inbox, and it will email you if your address shows up in a future breach. The confirmation step exists so nobody can sign you up without your say-so. If the confirmation email does not arrive, check your spam folder.

What a result does and does not mean

A hit means an address like yours appeared in a leak from a specific service, often years ago. It does not mean someone is using your account right now. A clean result does not prove you are safe either: it only covers breaches that made it into that collection. Use the result as a prompt to tidy up, not as a verdict.

How to check safely

Scammers love anything that looks like a security check, so be careful about where you type your address. Use this short routine.

Type the web address yourself. Do not follow a link from an email, text or social media post telling you to “check if you were hacked”. Open a fresh browser tab and enter the site’s address, or use a bookmark you made earlier.
Enter your email address only. A legitimate breach checker never asks for your current password, security-question answers, bank details or Social Security number.
Read the results by breach. You will usually see a list of breaches with the type of data exposed (email addresses, passwords, phone numbers and so on). Focus on breaches where passwords or financial details were included.
Check the other addresses you use. Old email addresses are often the ones that show up.
Consider signing up for alerts with the address you use most, so you hear about future breaches without having to remember to look.

The same site also has a separate password-check feature. A simpler, more cautious habit is to skip typing real passwords into any website and use your password manager’s built-in breach alerts instead, if it has them.

What to change first

The Federal Trade Commission’s advice after a breach follows a sensible order, and it is the same one you would use in a hurry.

1. Your email account

Start here. The FTC points out that password-reset links usually land in your email inbox, so anyone who controls that account can reset passwords elsewhere. Change this password first, and make it a new, unique one.

2. Any account that shares the exposed password

The FTC says to change the exposed password and any other account that uses the same or a similar one. Reuse is how a small leak becomes a big problem. Prioritize accounts that hold money or identity details: banking, payment apps, shopping accounts with saved cards, and anything tied to your phone number.

3. Two-factor authentication

Turn on two-factor authentication where it is offered. It means a stolen password alone is not enough to get in. Where you have a choice, an authenticator app or security key is stronger than text messages, but any second factor is better than none.

4. A password manager

The FTC suggests using a password manager so every account can have its own unique password without you memorizing them. If you are currently using the same three passwords everywhere, this is the single biggest improvement you can make.

5. Security questions

If answers to security questions were part of the exposure, change those too, since they cannot be “reset” by you the way a password can. Where a site lets you type an invented answer, do that and store it in your password manager.

Match the response to what was exposed

What leaked	Risk level	What to do
Email address only	Low	Expect more spam and phishing. Use unique passwords and 2FA.
Email plus password	Medium to high	Change that password everywhere it was used. Turn on 2FA.
Phone number or address	Medium	Watch for texts and calls that use your details to sound legitimate.
Payment card details	High	Check statements and ask your card issuer about replacing the card.
Social Security number or government ID	High	Freeze your credit, check your credit reports, and use IdentityTheft.gov.

When to freeze your credit

The FTC explains that a credit freeze makes it harder for an identity thief to open new accounts in your name. It restricts access to your credit file, it is free, and it does not hurt your credit score. To place one, you contact each of the three credit bureaus: Equifax, Experian and TransUnion. When you later apply for credit, you lift the freeze, and the FTC suggests finding out which bureau the lender will use and lifting it only there.

A fraud alert is the lighter-weight option. You place it with one bureau, which must tell the other two. An initial fraud alert lasts one year and can be renewed, and it asks businesses to verify your identity before opening new credit. An extended fraud alert lasts seven years and requires an identity theft report, which you can file at IdentityTheft.gov.

Rule of thumb: if only an email address or an old password leaked, a freeze is optional. If your Social Security number, date of birth plus address, or other identity details were exposed, freezing is a low-cost safeguard. Check your credit reports for accounts you do not recognize through the official free report site that the FTC points to, AnnualCreditReport.com. If someone has already misused your information, report it at IdentityTheft.gov, which builds a recovery plan for you.

Recognizing phishing after a breach

Breaches fuel scams because the criminals now know where you have an account. The FTC warns that scammers may send messages citing an old password or other personal detail to look credible. Watch for these patterns.

A message says your account was “compromised” and gives you a link or phone number to fix it.
An email quotes one of your old passwords and demands payment or threatens to expose something. A real password in a threat does not mean the sender has access to your devices; it usually came from an old leak.
Urgent language, deadlines or threats to close the account.
A sender name you recognize but a strange address, or a link that does not match the company’s real website.
Any request to share a verification code. A real company will not ask you to read one back to them.

The safe action is simple: do not click, do not call the number in the message, and go to the company’s website or app directly by typing the address yourself. The FTC’s general advice is not to share personal or financial information in a conversation you did not start.

Your 15-minute checklist

Check your main email address on a well-known breach checker you reached by typing the address yourself.
Change your email password to a new, unique one.
Turn on two-factor authentication for email, banking and your password manager.
Change reused passwords, starting with money-related accounts.
Sign up for breach alerts with your main address.
If sensitive identity details leaked, freeze your credit at all three bureaus.
Look over bank and card statements for charges you do not recognize.
Delete or ignore messages that quote old passwords.

Frequently asked questions

Is it safe to type my email into a breach checker?

With a well-known service that explains how it handles searches, generally yes, and it only needs your email address. Make sure you reached it by typing the address yourself, and never enter a password, bank detail or Social Security number.

My email was in a breach. Do I need a new email address?

Usually not. Change the password, enable two-factor authentication, and stay alert for phishing. A new address is mostly useful if the old one gets overwhelmed with spam.

Does a credit freeze affect my credit score?

According to the FTC, a freeze is free and has no effect on your credit score. You lift it temporarily when you apply for new credit.

An email says it has my password and demands money. What now?

Treat it as a scam. The password probably came from an old leak. Change it wherever it is still used, do not reply or pay, and report the message through your email provider.

Before you decide

A breach alert is an annoyance, not a disaster, if you respond in the right order: email account first, reused passwords next, two-factor authentication throughout, and a credit freeze when identity details were exposed. Use only well-known services, type their addresses yourself, and keep your password out of the process. Then get on with your day.