How to Check If Your Email or Password Was Leaked in a Data Breach in the UK

Data breaches now happen so often that most UK adults have probably had at least one account caught up in one. The hard part is knowing about it. A leaked email address or password can sit in criminal hands for months before it is used, and the first sign is often a strange login or an unexpected message from your bank. The good news is that checking takes a few minutes, and the tools are free. This guide shows you how to check your email and passwords against known breaches, what the results mean, and what to do next if your details turn up.

Start with Have I Been Pwned

The best place to start is Have I Been Pwned, a free service run by security researcher Troy Hunt. It holds records from data breaches that have become public, and it lets you check whether your email address appears in any of them.

Open haveibeenpwned.com in your browser and type in your email address, then press the search button. The site will tell you straight away whether the address was found in any known breach. If it was, you will see a list of the breaches involved, with the name of the service, the date of the breach and the kind of data that was exposed, such as email addresses, passwords or phone numbers.

Check every email address you use, including old ones you may have forgotten about. An old account you no longer use can still be a way into your other accounts if you reused its password. The site does not store your email address when you search, and it is widely used by security professionals, so it is a safe first check.

Check your saved passwords with Google

If you use Chrome or a Google account, Google Password Manager can check your saved passwords against lists of passwords known to have been exposed in breaches. Open Chrome, go to Settings, then Autofill and passwords, then Google Password Manager, and choose Checkup. You can also go directly to passwords.google.com and sign in.

The checkup scans the passwords you have saved and flags three things: passwords that have appeared in a known data breach, passwords you have reused across more than one site, and passwords that are weak and easy to guess. Pay most attention to the compromised ones, because those are the passwords criminals may already hold. The checkup will link you to each affected site so you can change the password straight away.

Check on your iPhone with Apple

Apple builds a similar check into its devices. On an iPhone, open the Passwords app, or open Settings and then Passwords on older versions, and look for Security Recommendations. This section lists any saved passwords that have appeared in a data breach, along with passwords that are reused or easy to guess.

Tap any entry to see which account it relates to and follow the link to change the password. In most recent versions of iOS you can also turn on a setting called Detect Compromised Passwords, which lets your phone warn you when a saved password shows up in a breach. The check happens on your device, so Apple does not see your passwords.

What to do if your details were leaked

Finding your email in a breach is not a reason to panic, but it is a reason to act. Work through these steps, starting with the accounts that matter most.

First, change the password on every affected account, starting with your email account itself. Your email is the key to resetting passwords elsewhere, so it comes first. Use a password you have never used anywhere else, and make it long. A passphrase made of three or four random words is easier to remember than a short string of symbols, and it is harder to crack.

Second, turn on two-factor authentication wherever it is offered, especially on email, banking and social media. An authenticator app is stronger than a text message code, because text messages can be intercepted. In most recent versions of Android and iOS you can also set up a passkey, which replaces the password entirely and cannot be phished in the usual way.

Third, check the affected account for anything odd. Look at recent logins, connected devices and recovery settings. If you see a device or location you do not recognise, sign it out and change the password again. If the breach exposed payment details, check your bank statements and tell your bank if anything looks wrong.

Finally, watch out for phishing. Criminals often use leaked email addresses to send convincing scam messages, sometimes pretending to be the very service that was breached. Be suspicious of any message that urges you to act quickly, and never click a link in an email to reset a password. Go to the site yourself instead.

Frequently Asked Questions

Is it safe to type my email into Have I Been Pwned?

Yes. The service is run by a well-known security researcher and is used by governments and companies around the world. It does not store the email address you search for, and it only checks it against records from breaches that are already public. You should be careful with copycat sites, though, so always check you are on haveibeenpwned.com.

Does a breach result mean someone has my current password?

Not always. A breach result means your email address, and possibly an old password, appeared in a leaked set of data. If you have changed the password since the breach date, the leaked one may no longer work. Even so, change it again if it is reused anywhere, and check whether any other details, such as your phone number or address, were exposed.

How often should I check for breaches?

A quick check every few months is enough for most people, plus an extra check whenever a major breach is reported in the news. If your browser or password manager offers breach alerts, turn them on, because they will warn you automatically. After any check that finds a leak, change the affected passwords the same day.