Your Email Was in a Data Breach: What to Do Now (Step by Step)
A breach alert isn't a reason to panic, but it is a reason to act. Here's what to change first, what to ignore, and when to freeze your credit.
If your email address showed up in a data breach, change the password for the breached account right away, then change it anywhere else you used the same password. Turn on two-factor authentication or a passkey for your email account, and stay alert for phishing messages that mention the breach. If the breach exposed your Social Security number or financial details, freeze your credit too.
Most breach alerts mean a list of email addresses and (often scrambled) passwords got out. That’s fixable in an evening. The steps below are in order of what matters most.
First, figure out what actually leaked
“Your email was in a breach” can mean very different things. The data involved decides how worried you should be and what to do.
| What leaked | Main risk | What to do |
|---|---|---|
| Email address only | More spam and phishing | Watch for scam emails; nothing to change |
| Email + password (even hashed) | Account takeover, especially if you reused the password | Change that password everywhere you used it; add 2FA |
| Name, phone, address, date of birth | Targeted phishing, scam calls and texts | Be extra skeptical of messages that use your details |
| Social Security number, bank or card numbers | Identity theft and fraud | Freeze your credit, contact your bank, watch statements |
The company’s breach notice (by email or letter) usually lists the data types. If you learned about it from a breach-checking site instead, the site typically shows which data classes were exposed for each incident.
How to check which breaches include your email
Have I Been Pwned (haveibeenpwned.com) is a long-running free service that lets you search an email address against known breaches. It lists each breach, when it happened and what kind of data was involved. It doesn’t show your actual leaked password.
- Go to haveibeenpwned.com and type your email address.
- Review the list of breaches. Note the services you still use and the type of data exposed.
- Sign up for notifications so you get an email if your address appears in a future breach. The site sends a verification link to confirm the address is yours.
Other options: Google’s Password Checkup (in Google Password Manager) and Apple’s Passwords app both flag saved passwords that have appeared in known leaks. Many password managers do the same.
Be careful with “breach alert” emails themselves. Scammers copy them. Go to the breach-checking site or the company’s website by typing the address yourself rather than clicking a link in the message.
Step 1: Change the breached password (and every copy of it)
The real danger of a leaked password is credential stuffing: attackers take email-and-password pairs from one breach and try them on email, banking, shopping and social sites. If you reused that password, every one of those accounts is exposed.
- Sign in to the breached service directly (type the address yourself) and change the password.
- List every other account where you used the same or a similar password. Start with your email account, since it can reset everything else.
- Give each account a unique, long password. A password manager makes this realistic; the built-in ones from Apple and Google are free.
- If the service offers it, sign out of all other sessions after changing the password.
Step 2: Lock down your email account
Your email inbox is the master key to your online life, because password resets go there. Even if the breach wasn’t your email provider, protect it now.
- Turn on two-factor authentication. Our guide to two-factor authentication covers Google, Apple and Microsoft accounts step by step.
- Add a passkey if your provider supports it. Passkeys can’t be phished or reused, so a future breach of some other site can’t expose them. See how to set up passkeys.
- Check recovery options. Make sure the recovery phone number and backup email are yours and current.
- Review recent activity. Gmail, Outlook and iCloud all show recent sign-ins or devices. Remove anything you don’t recognize.
- Look for sneaky rules. Attackers sometimes add forwarding addresses or filters that hide incoming mail. Check your email settings for forwarding and filters you didn’t create.
Step 3: Watch for breach-themed phishing
After a big breach, scammers send messages that look like official follow-ups: “Verify your account,” “Claim your settlement,” “Your refund is ready.” Some include real details from the leak to seem convincing.
- Don’t click links or open attachments in unexpected messages about the breach.
- Go to the company’s site or app yourself to check for notices.
- Legitimate companies won’t ask for your full password, PIN or verification codes by email, text or phone.
- Expect more scam texts and calls if your phone number leaked. Scam texts often reuse leaked details to look convincing.
Step 4: If financial or ID data leaked, protect your credit
If the breach included your Social Security number, driver’s license, or bank or card details, take these extra steps:
- Freeze your credit at Equifax, Experian and TransUnion. It’s free and stops most new-account fraud. See how to freeze your credit.
- Call your bank or card issuer if card or account numbers were exposed. They can issue a new card number.
- Check your credit reports for accounts you didn’t open. You can get free reports from the three bureaus through AnnualCreditReport.com.
- Accept free monitoring if the company offers it, but sign up through the link in the official notice or the company’s website, not a random email.
If you find signs of actual identity theft, the FTC’s IdentityTheft.gov walks you through a personal recovery plan.
What you don’t need to do
- You don’t need to abandon your email address. Spam may increase, but a strong password plus 2FA keeps the account itself safe.
- You don’t need a paid “dark web scan” to know what to do. The free checks above cover the essentials.
- You don’t need to change every password you’ve ever had at once. Prioritize the breached account, reused passwords and your email, then work through the rest.
Bottom line
A breach alert is a to-do list, not a disaster. Change the leaked password and every copy of it, protect your email with 2FA or a passkey, and treat any message about the breach with suspicion. Freeze your credit only if sensitive financial or ID data was exposed. Doing these few things blocks the attacks that most breaches actually lead to.
FAQ
Is Have I Been Pwned safe to use?
It’s a long-established free service run by a security researcher, and searching by email doesn’t reveal your password. Still, type the address yourself rather than following links in unsolicited emails, since lookalike sites exist.
My password was “hashed” or “encrypted.” Do I still need to change it?
Yes. Weak or common passwords can often be cracked from leaked hashes. Changing it removes the risk entirely.
Should I close the account at the breached company?
If you don’t use it, closing it reduces future risk. Change the password first, remove saved payment methods, then follow the company’s account deletion steps.
Can someone hack my email just because my address leaked?
Not from the address alone. They need your password or a way around it. A unique password plus two-factor authentication or a passkey makes that very hard.
