Every few weeks another company admits that customer details have leaked. If you have used the internet for more than a few years, your email address has almost certainly turned up in at least one breach. That is not a reason to panic, but it is a good reason to check, because a leaked address and password pair is one of the most common ways criminals break into accounts. This guide explains how to find out whether your email has been exposed, what the results mean, and what to do next.
What a data breach actually is
A data breach happens when information held by an organisation is accessed or published without permission. It might be a hacked database, a misconfigured server or an employee mistake. The leaked data can include email addresses, usernames, hashed or plain-text passwords, phone numbers, dates of birth and sometimes delivery addresses. Breaches are usually about the company that lost the data, not about anything you did wrong, which is why checking is simply sensible housekeeping.
In the UK, organisations that suffer a breach affecting personal data are expected to report serious cases to the Information Commissioner’s Office (ICO) and, where there is a high risk to individuals, to tell the people affected. In practice, many people only find out months later, and some never hear at all. That gap is why independent checking tools exist.
How to check if your email has been in a breach
The best-known free service is Have I Been Pwned, run by security researcher Troy Hunt. You type in your email address and it tells you which known breaches include it. It does not show you your password, and it only searches the collections of leaked data that have been loaded into its index, so a clean result means “not found in what it knows”, not a guarantee of safety. You can also sign up for notifications, so you are told if your address appears in a future breach.
Other routes can help as well. Many password managers now include a built-in breach monitor that compares your saved logins with known leaks, and some browsers and phone operating systems offer a similar “compromised passwords” warning. If you already use one, switch the feature on. Our guide to password managers explained covers the options in more detail.
Check every address you have used, not just the main one: old work emails, the address you used for shopping, and any you set up years ago and half forgot. Attackers do not care which inbox is your favourite.
How to read the results
If your address appears, look at two details: which site was breached and what types of data were exposed. A breach that leaked only an email address and a name is annoying but low risk, mostly increasing the chance of junk mail. A breach that included passwords is more serious, especially if you reused that password somewhere else. A breach that included phone numbers or postal addresses raises the odds of convincing scam calls and texts.
More in Tech
Also note the date. A breach from ten years ago involving a site you no longer use is mostly historical, though you should still be sure you do not use that old password anywhere today. A recent breach deserves quicker action.
What to do if you find your email in a breach
Work through these steps in order of urgency. First, change the password on the breached account, and then on any other account where you used the same or a similar password. Reusing passwords is the main way one breach turns into several. Make each new password long and unique; a password manager makes that realistic.
Second, turn on two-step verification wherever it is offered, starting with your email, banking and any account that can reset others. Our walkthrough on setting up two-factor authentication shows the common methods and which are strongest. Where a site supports passkeys, they are even better because there is no password to steal; see passkeys explained.
Third, check the account’s recovery details. Make sure the recovery email and phone number are yours, and look at recent sign-in activity and connected devices. If anything looks unfamiliar, sign out of all sessions.
Fourth, keep an eye on your money. If financial details may have been involved, watch your bank statements and consider asking your bank for advice. In the UK, the National Cyber Security Centre (NCSC) and Action Fraud provide official guidance on reporting and recovering from fraud, and it is worth following their advice rather than relying on random forum posts.
Watch for follow-up scams
After a breach, criminals sometimes use the leaked details to make messages look believable. You might get an email quoting a real old password and demanding payment, or a text pretending to be your bank. Treat these with suspicion. A quoted old password usually comes from a breach list, not from a hacker watching you. Do not reply, do not click links, and do not pay. Contact the organisation using a number from its official website or the back of your card. Our article on stopping spam calls and texts explains how to report and block them.
Habits that reduce the damage next time
You cannot stop companies being breached, but you can limit what a breach costs you. Use a different password for every account. Use a separate email alias or address for low-value sign-ups so a leak there does not expose your main inbox. Delete accounts you no longer need, since data that a company does not hold cannot be leaked by it. And be sparing with personal details on forms: if a site does not need your date of birth, you do not have to give it.
It also helps to set a calendar reminder to run a breach check every few months, or simply subscribe to alerts and let the service do it for you.
The short version
Checking whether your email has been in a breach takes a couple of minutes and costs nothing. If you find a hit, change the affected password, never reuse it, switch on two-step verification and stay alert for scams that follow. This article is general information rather than professional security advice, so for serious fraud or identity theft, contact your bank, Action Fraud and, where relevant, the ICO.
