How to Check if Your Email or Password Was Leaked in a Data Breach

Finding out that your email or password was leaked in a data breach is unsettling, but it is also very common. Large breaches expose billions of records every year, and your address may be in one of them even if you did nothing wrong. The important thing is to check, find out exactly what was exposed, and act quickly. In this guide we show you how to check if your email or password was leaked in a data breach, using free tools you can trust, and what to do in the minutes and days after you get a bad result.

What Does It Mean When Your Email Is Leaked?

A data breach happens when attackers steal a database from a website or app, often containing email addresses, passwords, names and sometimes phone numbers or addresses. Those records are then sold or shared online. If your email appears in a breach, it means that address, and possibly the password you used on that site, is now known to strangers. That does not mean your accounts have already been broken into, but it does mean you should assume the password is compromised and change it. The risk is highest when you reuse the same password on several sites: an attacker who finds it in one breach will try it everywhere else. This is called credential stuffing, and it is one of the most common ways accounts are taken over.

Step 1: Check Your Email with Have I Been Pwned

Have I Been Pwned is a free, well-known service that lets you check whether your email address appears in a known data breach. Go to haveibeenpwned.com, enter your email address, and it will tell you which breaches included it and what kind of data was exposed. The site is run by security researcher Troy Hunt and is widely recommended by security experts. You can also sign up for a free notification, so you are emailed if your address appears in a future breach. Check every email address you use, including old ones, and make a list of the breaches that come up. Do not enter your password on this site; it only needs your email address to check the breach list.

Step 2: Check Your Passwords with a Trusted Tool

You should also check whether a specific password has been exposed. Have I Been Pwned offers a separate Pwned Passwords service that checks a password against a list of hundreds of millions of leaked passwords, without sending the full password to the server. Google offers a similar check in Chrome and in your Google Account under Password Checkup, which warns you about passwords that have appeared in a breach and about weak or reused passwords. Mozilla Monitor, formerly Firefox Monitor, is another free option that checks your email against breaches and explains what was exposed. Use one of these tools, not a random website that promises to check your password, because a fake checker could steal the password you enter. If a password has been exposed, change it everywhere you used it.

Step 3: Change Leaked Passwords and Turn On Two-Factor Authentication

If your email or password was leaked, act in this order. First, change the password on the breached site, and on every other site where you used the same password. Use a strong, unique password for each site: a long phrase you can remember, or a random password from a password manager. Second, turn on two-factor authentication, also called 2FA, on your email, banking, social media and shopping accounts, so that a stolen password alone is not enough to get in. Third, check your email account for signs of unauthorised access, such as forwarding rules you did not set, or password reset emails you did not request. If you use a password manager, it can generate and store unique passwords for you, and warn you about reused ones. For a free option, see our guide to the best free software for managing passwords on Windows.

What to Do If Your Password Was Leaked

If a password was leaked, do not just change it on one site. Attackers will try that password on email, banking, social media and shopping sites, so change it everywhere you used it, starting with your email account, because email can be used to reset other passwords. If the breach included other data, such as your phone number or address, be extra careful about phishing messages that use that information to look genuine. Check your bank and card statements for unfamiliar transactions, and consider a fraud alert with your bank if financial details were exposed. If the breach included a government ID number or a payment card, contact your bank and follow the advice in the breach notification letter. Keep a note of what you changed and when, so you can check back later. For help spotting the scams that often follow a breach, read our guide to spotting phishing emails on Windows.

How to Protect Yourself from Future Breaches

You cannot stop companies from being breached, but you can limit the damage. Use a unique password for every site, so one breach does not unlock all your accounts. Turn on two-factor authentication wherever it is offered, especially on email, because your email is the key to resetting most other accounts. Use a password manager so you do not have to remember dozens of passwords, and let it warn you about weak or reused ones. Be careful what you share online, and think twice before giving a website your real phone number or date of birth if it does not need it. Keep your browser and Windows updated, and learn how to create a strong Windows login PIN and password for your PC itself. Finally, check your email with Have I Been Pwned every few months, or sign up for its free breach alerts, so you hear about a new breach quickly.

How to Tell a Real Breach Alert from a Scam

After a big breach is in the news, scammers send fake breach alerts by email and text, hoping you will click a link and enter your password on a fake site. A real alert from Have I Been Pwned, Google or Mozilla will not ask you to click a link and enter your password. If you get a breach warning by email, do not click the link in the message. Instead, go directly to haveibeenpwned.com or your account settings by typing the address yourself, and check there. Be suspicious of messages that create urgency, threaten to close your account, or ask for payment to remove your data from a breach. If a message claims to be from a company you use, log in to that company’s site directly and check for a notice in your account. When in doubt, treat the message as a scam and delete it.

Frequently Asked Questions

Is Have I Been Pwned safe to use?
Yes. It is a well-known, free service run by security researcher Troy Hunt. It only asks for your email address, not your password, and it does not store your email in a way that exposes it. Many security experts and companies recommend it.

What should I do first if my email was in a breach?
Change the password on the breached site and on every site where you used the same password, starting with your email account. Then turn on two-factor authentication on your email and other important accounts.

Can I remove my email from a data breach?
No. Once your data has been stolen and shared, you cannot delete it from every copy. What you can do is change the leaked passwords, turn on two-factor authentication, and watch for phishing and fraud.

How often should I check for breaches?
Check every few months, and sign up for free alerts from Have I Been Pwned or Mozilla Monitor so you are notified when a new breach includes your address. Also check after any large breach you hear about in the news.

Conclusion

Checking if your email or password was leaked in a data breach takes only a few minutes with free tools such as Have I Been Pwned, Google Password Checkup and Mozilla Monitor. If you find a leak, do not panic: change the affected passwords, use a unique password for every site, and turn on two-factor authentication. Those three steps protect you more than any other. Then make a habit of checking for breaches and keeping your accounts secure, so the next leak is an inconvenience, not a disaster. For more ways to stay safe, read our guide to keeping your Windows PC safe from hackers. Find more free tools and practical Windows guides at InsuraBytes.

If you want a simple routine, set aside ten minutes every few months for a security check. Start by running your main email address through Have I Been Pwned, then open your password manager and change any password that is marked as reused, weak or exposed. While you are there, turn on two-factor authentication for any important account that still lacks it, and remove old accounts you no longer use, because every forgotten account is another place your data can leak from. It also helps to use a separate email address for shopping and newsletters, so a breach at a retailer does not expose the address you use for banking. Small habits like these take little time, yet they make a real difference the next time a breach makes the news.