# How to Check If Your Email Was in a Data Breach

URL: https://www.mytechnician.tech/tips/check-if-your-email-was-in-a-data-breach/
Published: 2026-08-07 | Author: Ankit Kumar
Tags: Security, Password, Online Safety, Privacy
Summary: Find out which breaches exposed your email and passwords, work out what is actually at risk, and fix it in the right order — without falling for a fake breach alert.

## The Problem
Companies get breached constantly, and when they do, the stolen database of email addresses and password hashes ends up on sale and eventually in public collections. If you have had the same email address for a decade, it is almost certainly in several.

The reason this matters is not the breached site itself — it is **credential stuffing**. Attackers take email-and-password pairs from one breach and try them automatically against email providers, banks, and shopping sites. Every account where you reused that password is now open, and nothing about your PC was ever compromised.

Checking your exposure takes five minutes. Acting on it correctly is the part most people get wrong: they change the password on the breached site and stop, leaving every reused copy in place.

> **Getting emails claiming your password and demanding payment?** That is sextortion spam using a breached password to look credible. The password is real and old; the claim about your webcam is not. Change the password, do not pay, do not reply.

## The Fix: Step-by-Step

### Step 1: Check Your Email Address
Go to **haveibeenpwned.com** — run by security researcher Troy Hunt, free, and the reference source for this. Enter your email address.

You will get a list of breaches naming the site, the date, and — importantly — **what data was exposed**: email only, passwords, addresses, security questions, or payment details.

Check every address you use, including old ones and any alias that receives real mail.

### Step 2: Check Your Passwords, Not Just Your Email
On the same site, use **Pwned Passwords**. It tells you whether a specific password appears in known breach data at all, regardless of which account it belonged to.

It is safe to use: your browser hashes the password locally and only sends the first five characters of that hash, so the service never sees your password. That design is called k-anonymity and it is why this tool is trustworthy while random "check your password" sites are not.

If a password you still use appears even once, it is on the lists attackers try first. Retire it everywhere.

### Step 3: Use Your Browser's and Password Manager's Built-In Check
* **Chrome/Edge:** `chrome://settings/passwords` → **Password Checkup** / **Password Monitor**. Flags saved passwords that are breached, reused, or weak.
* **Password managers:** 1Password Watchtower, Bitwarden Reports, Dashlane's health score.
* **Apple:** **Settings** → **Passwords** → **Security Recommendations**.
* **Google:** `passwords.google.com` → **Password Checkup**.

These are more useful than the manual check because they compare against everything you have saved and tell you which specific accounts need work.

### Step 4: Triage by What Was Actually Exposed
Not every breach needs the same response.

| Exposed | Risk | Action |
|---|---|---|
| Email address only | Spam and targeted phishing | No password change needed; expect more phishing |
| Email plus password | High | Change everywhere that password was used |
| Security question answers | High and permanent | Change the answers on every account using them |
| Address, phone, date of birth | Identity fraud, SIM swap | Tighten account recovery; watch for [SIM swap](https://www.mytechnician.tech/tips/prevent-sim-swap-attack-protect-phone-number/) |
| Payment card details | Direct financial | Cancel and reissue the card |

Security answers deserve emphasis: your mother's maiden name cannot be rotated. Once exposed, treat those questions as public and answer them with random strings stored in your password manager.

### Step 5: Change Passwords in the Right Order
Do not start with the breached site. Start with the accounts that can reset everything else.

1. **Email** — whoever controls your inbox controls your other accounts.
2. **Password manager** master password, if it was ever reused.
3. **Banking and payments.**
4. **Microsoft or Google account.**
5. **Every account sharing the breached password.**
6. The breached site itself, last, if you still use it.

Every new password must be unique and long. Do not invent them yourself for dozens of accounts — see [use a password manager safely](https://www.mytechnician.tech/tips/use-a-password-manager-safely/) and [create strong, memorable passwords](https://www.mytechnician.tech/tips/create-strong-memorable-passwords/) for the ones you must type.

### Step 6: Turn On Two-Factor Authentication Where It Matters
A password in a breach is much less dangerous when a second factor is required. Enable 2FA on email, banking, and cloud storage at minimum — app-based rather than SMS wherever offered.

Better still, add [passkeys](https://www.mytechnician.tech/tips/set-up-passkeys-passwordless-sign-in/) on the services that support them. A passkey cannot appear in a future breach because the site never holds anything reusable.

Full setup: [set up two-factor authentication](https://www.mytechnician.tech/tips/set-up-two-factor-authentication-2fa/).

### Step 7: Sign Out Everywhere and Check for Changes
A password change does not always terminate existing sessions, and an attacker who got in earlier may have made changes designed to keep access.

On each important account, check for: unknown devices in the sessions list, forwarding rules or filters in email settings, changed recovery email or phone, and unfamiliar connected apps. Then sign out of all sessions.

Detailed walkthrough: [review and revoke app access and active sessions](https://www.mytechnician.tech/tips/review-revoke-app-access-active-sessions/).

### Step 8: Set Up Monitoring for Next Time
On Have I Been Pwned, use **Notify me** to register your address for future breach alerts. It emails you when your address appears in a new dataset — usually well before the breached company gets around to telling you.

Password managers and browsers offer the same monitoring continuously. Turn it on and act on the alerts rather than dismissing them.

### Step 9: Reduce What a Future Breach Can Expose
* Use **email aliases** for signups — Apple's Hide My Email, Firefox Relay, or a catch-all domain. A breach then exposes an alias you can delete, not your real address.
* Do not save card details on shopping sites you use once. Use a virtual card number if your bank offers them.
* Close accounts you no longer use. Data you never gave cannot leak, and data on a dead account still can.

## What Not to Do
* **Do not use random "free breach check" sites.** Several exist to harvest addresses; some are outright phishing. Stick to Have I Been Pwned or the checker built into your password manager.
* **Do not click links in breach notification emails.** Real notifications exist, and so do fakes that imitate them exactly. Go to the site by typing the address yourself.
* **Do not pay a "data removal service"** promising to erase you from breach dumps. The data is already copied and distributed; nobody can recall it.
* **Do not change one character** of the breached password and reuse it. Credential-stuffing tools try common variations automatically.

## FAQ

### Is Have I Been Pwned safe to use?
Yes. It is a long-established free service run by a well-known security researcher, and the password check uses k-anonymity so your password is never transmitted. It is cited by governments and browser vendors, several of which use its dataset directly.

### My email is in six breaches. Does that mean I have been hacked?
No. It means services you signed up to were breached — the failure was theirs, not yours. Your accounts are only at risk where you reused the exposed password or where the breach included enough personal data to defeat account recovery.

### I got an email with my real password demanding Bitcoin. What do I do?
Ignore it and change that password wherever it is still in use. These are mass-sent extortion emails using an old breach dump to look convincing. The claims about recordings are fabricated. Never pay, never reply.

### Should I change my email address entirely?
Rarely worth it. Moving every account to a new address is a large job and the new one ends up in breaches too. Better to keep the address, make every password unique, enable 2FA, and use aliases for new signups.

### How often should I check?
Register for notifications rather than checking manually — you will hear about new exposures automatically. A manual re-check every six months, alongside a password-manager health review, is a reasonable rhythm.

### The breached site no longer exists. Do I still need to do anything?
Yes, if you reused that password. The site being gone does not remove the stolen data from circulation. Change the password everywhere else it was used and close the loop.

## Still Not Working?
If you are locked out of an account because someone changed the password first, go to [recover a hacked email account](https://www.mytechnician.tech/tips/recover-hacked-email-account/) or [recover a hacked Microsoft account](https://www.mytechnician.tech/tips/recover-hacked-microsoft-account/) and start the provider's recovery process immediately — the sooner it begins, the better it goes.

Related: [set up account recovery options](https://www.mytechnician.tech/tips/set-up-account-recovery-options/), [spot and avoid phishing emails](https://www.mytechnician.tech/tips/spot-avoid-phishing-emails-scams/), [protect your privacy on social media](https://www.mytechnician.tech/tips/protect-privacy-on-social-media/).

---
Source: https://www.mytechnician.tech/tips/check-if-your-email-was-in-a-data-breach/ — My Technician, free Windows 10/11 troubleshooting guides.
More guides: https://www.mytechnician.tech/llms.txt