Your Email Was in a Data Breach: What to Do Next
An email address in a breach is common and usually fixable. The order of your actions matters more than doing everything at once.
By Siddharth ShankarUpdated October 11, 2026Identify which breach it was, change the password for that service and any account that reused it, secure your main email with a unique password and multi-factor authentication, and be wary of phishing that uses the breach as bait. An exposed email alone rarely means identity theft, but reused passwords are the real risk.
Your email may already be in a known data breach. Find out in about 30 seconds.
Free · About 30 seconds · No sign-up · Email not stored
Seeing your email address in a breach database is unsettling, but it is one of the most common privacy findings. Billions of accounts appear in public breach collections. What matters is which data came with your email and whether you reused the same password.
This guide gives you an ordered plan. If you are still deciding whether the breach is serious, read what each type of breached data means first.
1. Find out which breach and what was exposed
A breach-checking service such as Have I Been Pwned lists each breach your address appears in, along with the kinds of data involved. Write down the service name, the year and the data types. A breach that exposed only an email address is a different problem from one that included passwords or phone numbers.
HIBP flags some entries as unverified, spam lists, malware-sourced or stealer logs. Those flags tell you how reliable the entry is and how the data was gathered. Sensitive breaches are only visible to the verified owner of the address after signing in.
1Change the password for that service
Even if the breach is old, change the password on the affected service if you still have the account. The FTC says to change passwords right away for that company and for any account that uses a similar one.
2Replace every reused password
If the breached password was used on other sites, change it everywhere. This stops credential stuffing, where attackers test stolen pairs on other websites. A password manager makes unique passwords practical.
3Secure your main email account
Your primary inbox is the reset point for your other accounts, so give it a unique password and turn on multi-factor authentication. The NCSC lists a strong separate email password and 2-step verification among its core tips.
4Add multi-factor authentication or passkeys elsewhere
Prioritize banking, shopping and social accounts. Where passkeys are offered, they resist phishing better than passwords do.
5Set up alerts for future breaches
HIBP's Notify Me feature emails you when your address appears in a new breach. It works only for an address you can access, because notifications go to that address.
2. Expect phishing and treat it carefully
After a breach, criminals often send messages that pretend to come from the affected company, or claim your data is for sale on the dark web. The FTC warns that such emails may be phishing and advises not to click links or use phone numbers in the message. If it might be real, contact the company through a website or number you already know. Read how to tell if a data breach notice is real or phishing.
Do not guess. See which breaches include your email and what leaked.
Free · About 30 seconds · No sign-up · Email not stored
3. Check for signs of misuse
For an email-only breach, look at your inbox rules and recovery options. Check which devices are signed in, whether forwarding rules were added and whether the recovery phone number is yours. Review banking alerts if the same email is used for finance.
If you see unfamiliar charges or accounts, move to what to do if your identity is stolen.
4. Reduce what the breach can connect to
Your email address links your accounts together. Spend a few minutes on cleanup:
- Delete accounts you no longer use. How to find old accounts you forgot about can help.
- Use different email addresses for important accounts and low-trust sign-ups.
- Check where else your address is public with how to find where your email address appears online.
5. Do not pay for panic
Marketing for monitoring services often leans on breach fear. Free steps cover most of the benefit: unique passwords, multi-factor authentication, breach alerts and, in the United States, free credit reports and freezes. Our guide on dark web monitoring explains what paid monitoring does and does not add.
Sources
- FTC: Have you been affected by a data breach? Read this (change passwords, multi-factor authentication)
- Have I Been Pwned: FAQs (breach flags, sensitive breaches, Notify Me)
- NCSC: Top tips for staying secure online (strong separate email password, 2-step verification)
Frequently asked questions
Should I change my email address after a breach?
Usually no. Changing passwords and adding multi-factor authentication is more effective. Consider a new address only if it receives constant spam or is tied to a compromised account you cannot recover.
How do I know if my password was exposed?
Breach databases list data types. You can also check passwords with Pwned Passwords, which uses k-anonymity so only the first five characters of a hash are sent.
Is an old breach still a risk?
It can be if you reused the password, so check that none of your current passwords match old ones. See should you worry about an old data breach.
Can I get my email removed from a breach database?
Breach databases record historical events, and the data is already in the hands of whoever stole it. Removing the listing would not undo the exposure, so focus on securing your accounts.
What does Notify Me do?
It emails you when the address you subscribe appears in a newly added breach. Notifications go only to that address, so you cannot monitor an address you no longer access.
See if your email has already leaked
- Checks your email against known data breaches
- Shows which sites leaked it, when, and what leaked
- We do not store the email you check
Change reused and leaked passwords
NordPass flags weak and reused passwords, and its Premium plan alerts you if your details appear in new breaches.
See NordPass →Affiliate link. We may earn a commission at no extra cost to you.
Prefer a one-time report first? Scan My Shadow, our sister service, $9.99.