How to Check If Your Email or Password Was in a Data Breach (and What to Do Next)

Data breaches happen so often now that most people have had at least one login exposed without ever knowing it. A breach does not always mean someone broke into your account. It often means a company you used lost a database containing emails and passwords, and that data later circulated online. Checking takes a few minutes, and the fix is straightforward.

Step 1: Check your email with Have I Been Pwned

The best-known free checking tool is Have I Been Pwned, at haveibeenpwned.com. It is run by security researcher Troy Hunt and holds a database of email addresses found in known breaches. Type in your email address and it tells you whether that address appears in any breach in its database, and which breaches those were.

Read the result carefully. A hit means your email appeared in a leaked dataset, not that your current password is necessarily known to attackers. If the breach included passwords, the site says so. If it only included emails, the risk is lower but your address can still be used for phishing. Check every email address you use, including old ones.

Step 2: Check your saved passwords with your phone or browser

Most modern phones and browsers can check your saved logins against known breached passwords. On iPhone, go to Settings, then Passwords, then Security Recommendations, where most recent versions flag accounts using passwords that have appeared in data leaks, as well as passwords reused across sites. On Android, open your Google Account security settings or the Password Manager in Chrome and look for the password checkup option, which reports compromised, reused, and weak passwords.

These checks compare a scrambled version of your password against breach data rather than sending it in plain text. If a password is flagged as compromised, treat it as exposed even if you do not remember the breach. Change it first on email, banking, and social accounts.

Step 3: Change exposed passwords, one strong and unique password per site

The single most important rule after a breach is never to reuse a password across sites. If one site leaks your password and you used the same one elsewhere, attackers can try it on every other service. This technique, called credential stuffing, is automated and fast.

Change each exposed password to a long, unique one. A password manager makes this far easier, because you only need to remember one strong master password while the manager creates and stores the rest. If you do not want a manager, use a long passphrase made of several unrelated words for each important account.

Start with your email account, because email is the key to resetting almost everything else. Then move to banking, shopping, and social accounts, doing the important ones on the same day you find the breach.

Step 4: Turn on two-factor authentication everywhere it matters

A strong password helps, but two-factor authentication, often shortened to 2FA, adds a second check that makes a stolen password far less useful. With 2FA on, signing in requires your password plus a code from an authenticator app, a security key, or a text message.

Turn it on first for your email, banking, and main social accounts. Authenticator apps are generally safer than text message codes, but any second factor is far better than none. Save the backup codes each service gives you when you set up 2FA, and store them somewhere safe and offline.

Where a service offers passkeys, consider using them. A passkey replaces the password with a key stored on your device and unlocked with your fingerprint, face, or device PIN. Because there is no password to leak or reuse, passkeys remove the most common breach risk at that site.

Step 5: Watch for phishing after a breach

After your email appears in a breach, expect more phishing messages. Attackers know your address is real and may know your name, old passwords, or services you used. A common trick is an email claiming your account was hacked, showing an old password as "proof," and demanding payment or a click. Do not reply, do not click, and do not pay. Real companies do not demand payment by email to keep an account safe.

Be extra careful with password reset emails you did not request. If you get one out of the blue, do not click the link. Go to the site directly by typing its address, sign in, change your password, and check recent activity. Also review the forwarding rules on your email account, since attackers sometimes set up forwarding to keep receiving your mail after you change the password.

Step 6: Clean up old accounts you no longer use

Old accounts are a hidden risk. Every account you created years ago and forgot about is another database that can leak your email and a password you may have reused. Search your inbox for welcome emails to jog your memory, then sign in to services you no longer use and delete the account where the service allows it. If deletion is not offered, change the password to a random one you do not use anywhere else and remove saved payment methods.

A breach is not a reason to panic, but it is a reason to act. Check your addresses, change exposed passwords, turn on two-factor authentication, and stay alert for phishing. Those steps close the most common paths attackers use.

Frequently Asked Questions

Does appearing in Have I Been Pwned mean my account was hacked?

Not necessarily. It means your email address appeared in a dataset from a known breach, which may have come from a company that stored your details. It does not prove anyone accessed your account. Treat it as a warning: change the password for that service and turn on two-factor authentication.

Is Have I Been Pwned safe to use?

Yes, security professionals use it widely, and it only asks for an email address, not a password. For password checks, use the password checkup built into your phone or browser, which compares scrambled password data rather than asking you to type passwords into a website.

What should I do if a breach included my bank details?

Act the same day. Change the password for that bank and any site where you reused it, turn on two-factor authentication, and check recent transactions for anything you do not recognize. Contact your bank through its official app or phone number if you see unfamiliar activity. Do not click links in emails about the breach; go to the bank directly.