How to Check If Your Email Was in a Data Breach

The Problem

Companies get breached constantly, and when they do, the stolen database of email addresses and password hashes ends up on sale and eventually in public collections. If you have had the same email address for a decade, it is almost certainly in several.

The reason this matters is not the breached site itself — it is credential stuffing. Attackers take email-and-password pairs from one breach and try them automatically against email providers, banks, and shopping sites. Every account where you reused that password is now open, and nothing about your PC was ever compromised.

Checking your exposure takes five minutes. Acting on it correctly is the part most people get wrong: they change the password on the breached site and stop, leaving every reused copy in place.

Getting emails claiming your password and demanding payment? That is sextortion spam using a breached password to look credible. The password is real and old; the claim about your webcam is not. Change the password, do not pay, do not reply.

The Fix: Step-by-Step

Step 1: Check Your Email Address

Go to haveibeenpwned.com — run by security researcher Troy Hunt, free, and the reference source for this. Enter your email address.

You will get a list of breaches naming the site, the date, and — importantly — what data was exposed: email only, passwords, addresses, security questions, or payment details.

Check every address you use, including old ones and any alias that receives real mail.

Step 2: Check Your Passwords, Not Just Your Email

On the same site, use Pwned Passwords. It tells you whether a specific password appears in known breach data at all, regardless of which account it belonged to.

It is safe to use: your browser hashes the password locally and only sends the first five characters of that hash, so the service never sees your password. That design is called k-anonymity and it is why this tool is trustworthy while random "check your password" sites are not.

If a password you still use appears even once, it is on the lists attackers try first. Retire it everywhere.

Step 3: Use Your Browser's and Password Manager's Built-In Check

Chrome/Edge: chrome://settings/passwords → Password Checkup / Password Monitor. Flags saved passwords that are breached, reused, or weak.
Password managers: 1Password Watchtower, Bitwarden Reports, Dashlane's health score.
Apple: Settings → Passwords → Security Recommendations.
Google: passwords.google.com → Password Checkup.

These are more useful than the manual check because they compare against everything you have saved and tell you which specific accounts need work.

Step 4: Triage by What Was Actually Exposed

Not every breach needs the same response.

| Exposed | Risk | Action | |---|---|---| | Email address only | Spam and targeted phishing | No password change needed; expect more phishing | | Email plus password | High | Change everywhere that password was used | | Security question answers | High and permanent | Change the answers on every account using them | | Address, phone, date of birth | Identity fraud, SIM swap | Tighten account recovery; watch for SIM swap | | Payment card details | Direct financial | Cancel and reissue the card |

Security answers deserve emphasis: your mother's maiden name cannot be rotated. Once exposed, treat those questions as public and answer them with random strings stored in your password manager.

Step 5: Change Passwords in the Right Order

Do not start with the breached site. Start with the accounts that can reset everything else.

Email — whoever controls your inbox controls your other accounts.
Password manager master password, if it was ever reused.
Banking and payments.
Microsoft or Google account.
Every account sharing the breached password.
The breached site itself, last, if you still use it.

Every new password must be unique and long. Do not invent them yourself for dozens of accounts — see use a password manager safely and create strong, memorable passwords for the ones you must type.

Step 6: Turn On Two-Factor Authentication Where It Matters

A password in a breach is much less dangerous when a second factor is required. Enable 2FA on email, banking, and cloud storage at minimum — app-based rather than SMS wherever offered.

Better still, add passkeys on the services that support them. A passkey cannot appear in a future breach because the site never holds anything reusable.

Full setup: set up two-factor authentication.

Step 7: Sign Out Everywhere and Check for Changes

A password change does not always terminate existing sessions, and an attacker who got in earlier may have made changes designed to keep access.

On each important account, check for: unknown devices in the sessions list, forwarding rules or filters in email settings, changed recovery email or phone, and unfamiliar connected apps. Then sign out of all sessions.

Detailed walkthrough: review and revoke app access and active sessions.

Step 8: Set Up Monitoring for Next Time

On Have I Been Pwned, use Notify me to register your address for future breach alerts. It emails you when your address appears in a new dataset — usually well before the breached company gets around to telling you.

Password managers and browsers offer the same monitoring continuously. Turn it on and act on the alerts rather than dismissing them.

Step 9: Reduce What a Future Breach Can Expose

Use email aliases for signups — Apple's Hide My Email, Firefox Relay, or a catch-all domain. A breach then exposes an alias you can delete, not your real address.
Do not save card details on shopping sites you use once. Use a virtual card number if your bank offers them.
Close accounts you no longer use. Data you never gave cannot leak, and data on a dead account still can.

What Not to Do

Do not use random "free breach check" sites. Several exist to harvest addresses; some are outright phishing. Stick to Have I Been Pwned or the checker built into your password manager.
Do not click links in breach notification emails. Real notifications exist, and so do fakes that imitate them exactly. Go to the site by typing the address yourself.
Do not pay a "data removal service" promising to erase you from breach dumps. The data is already copied and distributed; nobody can recall it.
Do not change one character of the breached password and reuse it. Credential-stuffing tools try common variations automatically.

FAQ

Is Have I Been Pwned safe to use?

Yes. It is a long-established free service run by a well-known security researcher, and the password check uses k-anonymity so your password is never transmitted. It is cited by governments and browser vendors, several of which use its dataset directly.

My email is in six breaches. Does that mean I have been hacked?

No. It means services you signed up to were breached — the failure was theirs, not yours. Your accounts are only at risk where you reused the exposed password or where the breach included enough personal data to defeat account recovery.

I got an email with my real password demanding Bitcoin. What do I do?

Ignore it and change that password wherever it is still in use. These are mass-sent extortion emails using an old breach dump to look convincing. The claims about recordings are fabricated. Never pay, never reply.

Should I change my email address entirely?

Rarely worth it. Moving every account to a new address is a large job and the new one ends up in breaches too. Better to keep the address, make every password unique, enable 2FA, and use aliases for new signups.

How often should I check?

Register for notifications rather than checking manually — you will hear about new exposures automatically. A manual re-check every six months, alongside a password-manager health review, is a reasonable rhythm.

The breached site no longer exists. Do I still need to do anything?

Yes, if you reused that password. The site being gone does not remove the stolen data from circulation. Change the password everywhere else it was used and close the loop.

Still Not Working?

If you are locked out of an account because someone changed the password first, go to recover a hacked email account or recover a hacked Microsoft account and start the provider's recovery process immediately — the sooner it begins, the better it goes.