You can check if your email was in a data breach for free in under a minute using Have I Been Pwned, the breach monitor in your password manager, or the security check in your Google or Apple account. If your email appears, change the password for that service and any account where you reused it, then turn on two-factor authentication. This guide explains how to read the results and what to do next.
Key takeaways
- Have I Been Pwned is a free, widely trusted breach lookup service.
- Appearing in a breach is common; what matters is which data was exposed.
- Change reused passwords first, then turn on two-factor authentication.
- Sign up for breach notifications so you hear about future incidents quickly.
How do you check if your email was in a data breach?
The quickest way to check if your email was in a data breach is to enter it on Have I Been Pwned, a free service run by security researcher Troy Hunt. It searches billions of records from known breaches and lists which services exposed your address.
- Visit Have I Been Pwned and enter your email address.
- Review the list of breaches and the data types each one exposed.
- Sign up for free notifications about future breaches.
- Check your password manager’s breach or password health report too.
What does it mean if your email appears in a breach?
If your email appears in a breach, a company you used lost data that included your address and possibly other details. The risk depends on what else was exposed, so read the data types listed for each breach.
| Data exposed | Risk | What to do |
|---|---|---|
| Email only | More spam and phishing | Be alert to targeted emails |
| Passwords (even hashed) | Account takeover where reused | Change it everywhere it was used |
| Phone number | Smishing, SIM swap attempts | Add a carrier PIN; distrust unexpected texts |
| Address, date of birth | Identity fraud | Consider a credit freeze |
| Payment card | Fraudulent charges | Ask your bank for a new card |
What should you do after finding your email in a data breach?
After finding your email in a data breach, change the exposed password, change it anywhere you reused it, turn on two-factor authentication, and watch for phishing that mentions the breached company. These four steps block most follow-on attacks.
A password manager makes unique passwords easy, and two-factor authentication stops criminals who already have your password. Our full guide on what to do after a data breach follows soon.
Is Have I Been Pwned safe to use?
Have I Been Pwned is safe to use and is widely trusted by security professionals and governments. It only asks for your email address, never your password, and its password-check feature uses a method that never sends your full password.
Be careful with copycat sites that ask for passwords or payment. The UK’s NCSC data breach guidance explains how to respond to breach notifications from companies.
How can you reduce the damage from future breaches?
You reduce damage from future breaches by using unique passwords, two-factor authentication, email aliases for sign-ups, and sharing less personal data. Breaches will keep happening, but these habits limit what criminals can do with the stolen data.
Our guide to how your data is tracked and recorded covers how to reduce the data companies hold about you in the first place.
Frequently asked questions
My email was in a breach years ago. Should I still act?
Yes, if you reused the password from that service anywhere. Old breach data is still traded and used in credential-stuffing attacks. Change any reused passwords and turn on two-factor authentication.
Can Have I Been Pwned remove my data from the breach?
No. It only reports which breaches contain your data. The stolen data is already in criminal hands, so the goal is to make it useless by changing passwords and adding two-factor authentication.
What is credential stuffing?
Credential stuffing is an attack where criminals take email and password pairs from one breach and try them on many other websites. It works because people reuse passwords, which is why unique passwords matter.
Should I delete accounts I no longer use?
Yes. Old accounts still hold your data and can be breached. Deleting them reduces your exposure. Use your password manager list to find accounts you have forgotten.
Next steps
Checking if your email was in a data breach takes a minute, and acting on the result takes about half an hour. Run the check today, fix reused passwords, and turn on two-factor authentication for your email first. Businesses can review their wider exposure with the free Cybersecurity Readiness Assessment.
