Was my email in a data breach? How to check, and what to do
Your email address has very likely appeared in at least one company's data breach. That alone is not an emergency. What matters is whether a password you still use leaked with it.
Search your address free at Have I Been Pwned (haveibeenpwned.com) and turn on its alerts. Then run Google Password Checkup (passwords.google.com) or your password manager's check to find leaked or reused passwords. Change any password that leaked, never reuse passwords, and turn on 2-Step Verification or a passkey.
Free ways to check
| Tool | What it tells you |
|---|---|
| Have I Been Pwned | Which known breaches your email address appears in. Free, with optional email alerts for future breaches. |
| Google Password Checkup | Which passwords saved in Google Password Manager were exposed, reused or weak. In Chrome or at passwords.google.com. |
| Mozilla Monitor | Free breach alerts for up to 20 email addresses. |
| Your password manager | Most (1Password, Bitwarden, Apple Passwords and others) flag leaked and reused passwords. |
Note: Google's dark web report was discontinued in early 2026. Google now points people to Password Checkup and Security Checkup instead.
How to read the results
- Email address only leaked: expect more spam and phishing. No password change needed for that breach.
- Password leaked: change it on that site and anywhere else you used the same one. This is the urgent case.
- Phone number, address or date of birth leaked: be extra wary of calls and texts that "know" your details. Consider a credit freeze if financial details or ID numbers were included.
Five things to do now
- Change leaked and reused passwords, starting with your email account. Whoever controls your email can reset everything else.
- Use a different password for every site. A password manager makes this easy.
- Turn on 2-Step Verification for your email. Phone prompts or an authenticator app are safer than text messages.
- Add a passkey where offered. Google, Microsoft and Apple accounts all support them, and they cannot be phished.
- Check your email settings for forwarding rules or filters you did not create. Attackers add these quietly. See how to check Gmail filters and forwarding.
Spotting the phishing that follows a breach
After a breach, scammers send emails that mention the breach or use your real details. Do not click "secure your account" links in emails. Go to the website yourself, or open its app. Real companies will not ask for your password or a verification code by email or phone.
Questions people ask
- Is Have I Been Pwned safe to use?
- Yes. It is a long-running, widely trusted free service. You enter only your email address, never a password.
- My email was in a breach. Should I make a new email address?
- Usually not. Change the leaked passwords and turn on 2-Step Verification. A new address only helps if the old one gets overwhelming amounts of spam.
- How do I check if someone is using my email account?
- In a Google Account, open Security and review Your devices and recent activity. In a Microsoft account, check Recent activity. Sign out of anything you do not recognize and change your password.
Sending one email to a whole list? Check the addresses first with Veml, which removes bad and risky emails before you hit send. (Veml and EmailNa have the same owner.)