What to do if your email is in a data breach

Finding your email address in a data breach is unsettling, but it's common and usually manageable. It means a company you dealt with lost its customer data, not that someone is inside your inbox. What you need to do depends on what else leaked alongside your address. This guide gives the steps in order, explains each type of exposed data, and shows the scam emails that usually follow a breach.

What should I do right now?

If you've just found out, do these five things today:

1. Find out what leaked. Read the company's breach notice on its own website, or look up the breach on Have I Been Pwned. Note whether passwords, phone numbers, addresses or ID numbers were included.
2. Change the password for the breached site and anywhere you reused it. The FTC says to "immediately change the password you use with that company and on your accounts using a similar password" (FTC).
3. Secure your email account first if its password was the same or similar. Your inbox receives the reset links for everything else.
4. Turn on multi-factor authentication (two-step verification): a passkey, security key or authenticator app.
5. Distrust emails about the breach. Go to the company's site yourself instead of clicking links in messages.

The rest of this guide explains why each step matters and what to add if more than your email leaked.

What does it mean if my email was in a data breach?

A data breach is when an organization loses control of data it holds about you, usually through a hack or a misconfigured system. When your email address appears in one, it means that a service you signed up for, perhaps years ago, had its user list copied.

It does not mean your email account itself was broken into. Your mailbox is at risk only if a password you use for email was exposed, directly or because you reused it. To check your account, look at your recent sign-in activity; our guide to whether someone can hack your email without your password shows where that is in Gmail and Outlook.com.

The UK's National Cyber Security Centre explains why it still matters: "Criminals can then use this information when creating phishing messages", so scams look more convincing (NCSC).

How do I check if my email was in a data breach?

Use a breach lookup service or your password manager, never a link in an unexpected email.

• Have I Been Pwned (haveibeenpwned.com). Enter your email address to see which known breaches included it and what types of data leaked. The NCSC links to it as one of the "online tools that you can use". The site says that when breach data is loaded, "no corresponding passwords are loaded with them", and it won't send you your exposed passwords (HIBP FAQs). You can also sign up for free alerts about new breaches.
• Your password manager. The NCSC notes that some antivirus and password manager tools offer similar checks, flagging saved passwords that appear in known breaches. Google points users to Password Checkup in Google Password Manager.
• The company's own notice. If a company tells you it was breached, read the notice on its official website. Don't rely on links in an email that claims to be the notice.

Google's free dark web report is gone. Google says scans for new breaches stopped on January 15, 2026, and the report stopped being available on February 16, 2026 (Google Search Help). If you relied on it, use one of the options above instead.

A clean result doesn't prove you're safe. Have I Been Pwned only knows about breaches that have been made public, and its FAQ says a missing result doesn't mean the address "hasn't been compromised in another breach".

What should I do based on what leaked?

Match your response to the data exposed. This table draws on the FTC's IdentityTheft.gov data breach steps, which has the full list by type of information.

For an exposed login, the FTC's steps are: "Log in to the account and change your password. If possible, also change your username." If you can't log in, contact the company and ask how to recover or shut down the account. And if you used the same password anywhere else, "change that, too."

For a Social Security number, IdentityTheft.gov suggests accepting free credit monitoring if the company offers it, getting your free credit reports from AnnualCreditReport.com, and freezing your credit. The FTC calls a freeze free and "the best way to protect against an identity thief opening new accounts" (FTC). A free one-year fraud alert, placed with one of the three credit bureaus, is a lighter alternative.

Do I need to change my email password?

Change it if your email password, or anything like it, was used on the breached site. Otherwise, a breach elsewhere is not a reason to change a strong, unique email password.

Your email account deserves special care because it controls the rest. Password reset links for your bank, shopping and social accounts all go to your inbox. The FTC's advice after a breach scare is: "Start by changing the passwords on your email accounts" (FTC).

This matches current US government password guidance. NIST's digital identity guidelines say services should check new passwords against "known commonly used, expected, or compromised passwords" and should "force a change if there is evidence that the authenticator has been compromised", but should not require routine periodic changes (NIST SP 800-63B-4). In plain English: change a password when there's a reason, then make the new one unique.

A password manager makes unique passwords practical, and the FTC suggests considering one. Better still, add a passkey to your email account where it's offered: there's no password to leak. See passkeys for email.

What scams follow a data breach?

Breached data fuels phishing. Expect more of these in the weeks and months after a breach:

• Fake breach notifications that copy the company's branding and ask you to "verify your account".
• "Your data is for sale on the dark web" emails. The FTC warns these can be scams that quote partial personal details to look real. Don't click links or call numbers in them; contact the company "using a website or phone number that you know is real" (FTC).
• Sextortion emails quoting an old password. The password usually came from an old breach. See sextortion scam emails.
• Targeted phishing that uses your name, order history or phone number to seem legitimate.

An example of a fake breach email (example only):

From: "Account Security" <security@example-shop-support.com>
Subject: Action required: your account was affected by our security incident

We recently identified unauthorized access affecting your account.
To keep your account active, confirm your identity and payment details
within 24 hours: https://example-shop-verify.com/secure

The urgency, the request for payment details and the lookalike domain all give it away. A real company's notice tells you what happened and what it's doing. It doesn't demand your card number through a link. For more signs, read how to spot a phishing email.

Should I change my email address after a breach?

Usually not. Almost every address that has been used for a few years shows up in some breach. Changing addresses means updating every account and telling every contact, and the new address will leak eventually too.

Secure the address you have instead: a unique password, a passkey or app-based two-step verification, good spam filtering, and a separate address for shopping and sign-ups. Our guide on where spammers get your email address explains how addresses leak and how to limit it.

What should a business do when staff emails are in a breach?

Work addresses leak too, usually because staff used them to sign up for outside services. For a small business:

1. Check your domain's exposure. Have I Been Pwned lets you add and search domains you own from its dashboard, after verifying you control the domain. At the time of writing (November 2026), its FAQ says larger domains normally need a paid subscription to see results.
2. Reset reused passwords for affected staff, and require unique passwords.
3. Require multi-factor authentication for every mailbox, ideally phishing-resistant methods like passkeys.
4. Warn staff to expect targeted phishing, especially fake invoices and payment change requests. See business email compromise prevention.
5. Watch for lookalike domains. Criminals use breach data with domains that resemble yours. The free Lookalike Domain Generator shows which ones exist.
6. Filter inbound mail so breach-fueled phishing is stopped before it reaches staff. See how iBlockSpam protects small businesses.

The small business email security checklist covers the wider set of controls.

Next steps

1. Look up your address on Have I Been Pwned and note what leaked in each breach.
2. Change every exposed or reused password, starting with your email account, and add a passkey or app-based two-step verification.
3. If your Social Security number leaked, place a free credit freeze and check your credit reports.
4. Treat any email about the breach as suspicious; go to the company's website directly. If you're unsure about a message, check its headers in the free Email Header Analyzer.
5. For a business, reset reused passwords, enforce MFA and filter inbound phishing. iBlockSpam's small business page explains how its filtering works.