Should You Worry About an Old Data Breach?

Time makes some breaches harmless and others permanent. The question is which data leaked and whether you changed anything since.

By Siddharth ShankarUpdated October 11, 2026

Many people find their email in a breach from ten years ago and wonder whether it is still worth acting on. The honest answer is: sometimes. Age matters less than what leaked and what has changed since.

Why old breaches can still matter

Some data does not expire. Dates of birth, former and current addresses, phone numbers and government IDs remain useful long after a breach. Passwords also matter if you reused them, because attackers test old lists against new sites. OWASP notes that many users re-use the same password and username or email, which is what makes credential stuffing work. See credential stuffing explained.

Old breaches also keep circulating. A collection stolen years ago can be combined with newer ones to build fuller profiles.

When it is probably fine

• The breach exposed only an email address or username.
• You have never reused the breached password and no longer use that service.
• You have unique passwords and multi-factor authentication on key accounts.
• The data was of a type that is out of date, such as an old address you no longer use.

Even then, expect some spam and be cautious about messages that mention the old service.

When to take action

• The breach exposed a password and you reused it, even in a modified form.
• It included a date of birth, address, phone number or national ID that is still yours.
• It included financial details tied to accounts you still hold.
• Your email appears in many breaches and is also used for important accounts.

How to check quickly

What you cannot undo

You cannot erase a breach, and you cannot make a criminal forget your data. You also cannot easily change a date of birth. Public records and old data broker profiles can reappear because new sources keep feeding them. For that reason, see why data broker profiles contain old information.

A simple decision rule

1. Did it include a password you ever reused? Change it everywhere. 2. Did it include data you cannot change? Reduce what can be done with it by freezing credit and tightening account recovery. 3. Neither? Add alerts, move on and keep your habits strong.

A simple way to judge an old breach

In our view, three questions decide whether an old breach still matters. First, did it include a password you have reused anywhere? If so, change it now. Second, was the exposed data something that can be changed, such as a password, or something that cannot, such as a date of birth? Fixed details stay useful to criminals for years. Third, are you seeing signs of misuse, like unfamiliar accounts, odd texts or credit inquiries you did not make? A breach from a decade ago with no reused password and no signs of misuse is usually a lower priority than a recent one.