Has My Email Been in a Data Breach? How to Check (and What to Do)

Every time a company gets hacked, its customers’ details can end up being traded online: email addresses, passwords, names, phone numbers, sometimes dates of birth. Criminals use these lists to break into accounts and to write scam messages that sound real. The good news is you can check if your email address has been caught up, for free, in about a minute.

1. Check with Have I Been Pwned

Have I Been Pwned (HIBP) is a free, long-running service that lets you search one email address at a time against known data breaches. Enter your address and it lists the breaches it appears in, what kind of data leaked, and when. Some “sensitive” breaches only show once you verify you own the address (HIBP FAQs).

Two things to know: if you appear in a breach for a site you don’t remember joining, the data may have been sold or passed on, or the site may have changed its name. And if your address isn’t found, that doesn’t prove it’s safe. HIBP holds only a small subset of all breached records, and many breaches are never made public (HIBP).

2. Change exposed and reused passwords

The real danger is password reuse. If you use the same password on several sites and one is breached, criminals can try it everywhere else (UK NCSC). Change the password for any breached account, and anywhere else you used it. Start with your email account (it can reset everything else), then banking, shopping and social media. HIBP’s Pwned Passwords tool checks whether a password has appeared in a breach; if it has, stop using it (HIBP).

3. Use a password manager

Nobody can remember a different strong password for every account. A password manager does it for you: it creates strong, unique passwords, fills them in, and syncs them across your devices. The UK’s National Cyber Security Centre recommends them, and notes that the one built into your browser or phone is fine on your own devices (NCSC). Where a site offers passkeys, the NCSC recommends using them (NCSC).

4. Turn on two-factor authentication (2FA)

2FA (also called two-step verification or multi-factor authentication) means a stolen password alone isn’t enough to log in: you also need a code from an app, a text, a security key or your fingerprint. The FTC says it makes it harder for scammers to get into your accounts even if they have your username and password (FTC), and the NCSC calls turning it on the first and most important step (NCSC). Turn it on for email first, then banking and social media.

5. Watch for phishing that uses your leaked details

Leaked data makes scam emails and texts more convincing: they may use your real name, mention a company you really use, or even quote an old password to frighten you. The FTC’s warning signs: messages saying there’s suspicious activity on your account, a problem with your payment details, or that you need to confirm personal information, usually with a link (FTC). Don’t click. Go to the company’s website or app yourself, or call a number you already know.

6. If more than your email leaked

If a breach exposed ID numbers, your date of birth or financial details, follow your country’s identity theft advice. In the US, the FTC’s IdentityTheft.gov data breach page has steps; in Australia and New Zealand, IDCARE offers free support.

7. Get told about the next breach

HIBP offers free “Notify me” alerts for your address. If you want ongoing monitoring for several personal addresses alongside other scam protection, our Personal plan (US$9/month) includes breach and dark web leak alerts for up to three personal email addresses, account recovery help and one romance scam check a month. Related: how to tell if a call is a scam and how to check if someone you met online is real.

Questions

Does Have I Been Pwned show my password?

No. HIBP doesn’t store passwords next to email addresses and won’t send you a leaked password. Its separate Pwned Passwords tool lets you check whether a password has appeared in breaches.

My email wasn’t found. Am I safe?

Not necessarily. HIBP says it holds only a subset of all breached data, and many breaches are never made public. Good password habits and 2FA still matter.

Is it safe to enter my email into Have I Been Pwned?

HIBP says searches are not logged and are sent over an encrypted connection, and that an email address alone isn’t enough to get into your accounts.

Get breach alerts for your emails

ImposterWatch Personal (US$9/month) watches up to three personal email addresses for new data breaches and dark web leaks, and includes one romance scam check a month and account recovery help.

See the Personal plan Romance scam warning signs

More guides

General information only, not legal or financial advice. ImposterWatch is operated by Cloud Investments FZE (UAE) and is not a background check or private investigator service.

How to check if your email was in a data breach (and what to do)