How to Check If Your Email Was in a Data Breach
A data breach means a company holding your details was broken into, and some of that information ended up in other hands. It does not automatically mean someone is in your accounts — but it does mean you should act on the passwords and details that were exposed. Checking takes a few minutes.
Follow these steps
- Use a reputable breach-lookup service. Search for a well-known breach-checking service and use its email lookup. Type in the email address you want to check and read the result carefully — it will list which breaches, if any, included that address.
- Read what was actually exposed. Different breaches expose different things: sometimes only an email address, sometimes passwords or other details too. What you need to change depends on what was included, so do not treat every result as equally serious.
- Change the password for any affected account. If a password for an account was exposed, change that password straight away to a new, unique one. If you reused that password anywhere else, change it on those accounts too.
- Turn on two-factor authentication. For your email and any affected account, turn on two-factor authentication if it is not already on. That way, an old leaked password alone is not enough to get in.
- Watch for phishing using the leaked details. After a breach, expect convincing scam emails that use real details about you. Be extra careful with unexpected messages, especially ones asking you to click a link or confirm account details.
- Check your other email addresses too. Repeat the lookup for any other email address you use. People often forget an old address that still unlocks accounts, so checking all of them closes a gap you might otherwise miss.
What NOT to do
- Do not panic and delete accounts you still need — change the passwords and turn on two-factor authentication instead.
- Do not enter your password into a breach-checking site. A genuine lookup only asks for the email address.
- Do not ignore a breach because nothing bad has happened yet. Leaked details are often used months later.
- Do not reuse the exposed password with a small change, such as adding a number at the end.
Once the affected passwords are changed and two-factor authentication is on, you have done the important work. Keep the habit of checking a new email address whenever you start using it for important accounts.