Data Breach: What to Do When Your Email Shows Up in a Leak

Last updated: October 8, 2026

You get a notice, or you check a breach-lookup site, and it says your email address appeared in a data breach. It is an unpleasant surprise, but it is also very common. It does not automatically mean your accounts have been hacked or that criminals are watching you. It does mean you have some work to do.

This guide explains what a breach notification means, how to find out what was exposed, and the order in which to fix things. It is aimed at ordinary users and needs no technical background.

What Does "Your Email Was in a Breach" Mean?

A data breach happens when someone gains unauthorized access to a company's data, or when data is accidentally exposed. Records from the affected service, which could include email addresses, names, phone numbers, passwords or other details, can then be copied and shared or sold.

Seeing your email in a breach usually means that an account you created with that email on the affected service was included. The key question is what else came with it. An email address alone is a minor exposure, mainly leading to more spam and phishing. An email plus a password, especially one you reuse, is much more serious.

Step 1: Confirm the Notice Is Genuine

Breach notices are a favorite disguise for phishing. Before doing anything else:

• Do not click links in the email. Go to the company's official website by typing the address yourself, or use its official app, and check for an announcement.
• Be suspicious of messages demanding you act immediately or asking you to enter your password to "check whether you were affected".
• If the notice came from a breach-checking service you use, open the service yourself instead of using the email link.

How to Check Whether a Breach Letter or Email Is Real

Real companies do send breach notices by mail and email, and some offer free credit monitoring. Scammers copy them. Before you call a number, scan a QR code or sign up for an offer in a notice:

1. Find the company's phone number or website yourself, from a past statement, the back of your card, or by typing its address. Do not use the number, link or QR code in the notice.
2. Call and ask whether the notice is genuine and what was exposed.
3. If a free monitoring offer is real, the company can confirm the enrollment details and code.
4. Never give your password, full card number or Social Security number to someone who called or texted you about a breach.

Step 2: Find Out What Was Exposed

Have I Been Pwned, a free service run by security researcher Troy Hunt, lets you enter an email address at haveibeenpwned.com to see which known breaches included it, and what data types were involved, such as passwords or phone numbers. Some sensitive breaches are only shown after you verify by email that you own the address. Many password managers and browsers also have built-in breach alerts. Google's Password Checkup and similar tools in Apple and Microsoft products can flag saved passwords that have appeared in known leaks.

Use these tools carefully:

• Type the address of the checking site yourself. Do not enter your email address in a site you reached from an unsolicited message.
• Never type your actual passwords into a random website to see whether they leaked. Reputable services use methods that do not require sending the whole password, and you should stick to well-known ones.
• Remember that these tools only know about breaches that have become public. No result does not prove your data is safe.

Write down which service was breached and what data was involved. This dictates the rest of your steps.

Step 3: Change the Password on the Affected Account

If a password may have been exposed, go to the real service and change it straight away, using a strong and unique one. If you can no longer sign in, use the "Forgot password" process. Most companies hash passwords before storing them, which makes them harder to read, but weak passwords can still be cracked, so do not rely on that.

If the service has closed or you no longer use it, consider deleting the account, or at least removing what you can.

Step 4: Change Reused Passwords Everywhere

This is the step that matters most. Attackers take leaked email and password pairs and try them on other popular services, a technique called credential stuffing. If you used the same or a similar password elsewhere, treat all of those accounts as at risk. The FTC also advises changing the password right away on the affected account and on any account using a similar one, and turning on multi-factor authentication.

1. List where you may have used the same password or a close variation. Start with email, banking, shopping, social media and cloud storage.
2. Change your main email password first, because it can reset everything else.
3. Then change the others in order of importance.
4. Give each account a different password. A password manager can create and store them so you do not need to memorize them.

Small tweaks such as changing a number at the end are not enough, since attackers try those patterns.

Step 5: Turn On Two-Factor Authentication

With 2FA enabled, a stolen password alone is not enough to get into your account. Prioritize your email, financial services and any account that holds personal or payment data. An authenticator app or security key is stronger than text-message codes when the service offers a choice. Save any backup codes safely.

Step 6: Check Your Accounts for Signs of Misuse

• Look at recent sign-in activity and devices in your important accounts, and sign out of ones you do not recognize.
• Check your email for forwarding rules or filters you did not create.
• Look through bank and card statements for transactions you do not recognize.
• Review any password-reset emails you did not request.

If you spot anything suspicious, see our guides on how to tell whether your email has been hacked and how to recover a hacked Google account.

Step 7: Act Depending on What Leaked

The FTC's advice after a breach notice is to change passwords right away, turn on multi-factor authentication, and check what information was exposed. Its site IdentityTheft.gov/databreach has step-by-step checklists for each type of data. This table summarizes the main actions:

What leaked	Main risk	What to do
Email address only	More spam and phishing	Watch for phishing; do not click links in breach-related messages
Password	Account takeover, including other sites where you reused it	Change it on that site and everywhere you used it or something similar; turn on 2FA
Phone number	Scam texts and calls, SIM-swap attempts	Treat unexpected texts with suspicion; ask your carrier about a PIN or port-out protection
Payment card	Fraudulent charges	Call your card issuer using the number on the card; ask about a replacement
Bank account details	Unauthorized withdrawals	Contact your bank; watch statements closely
Social Security number	New accounts or tax returns in your name	Free credit freeze at Equifax, Experian and TransUnion; follow IdentityTheft.gov
Address and date of birth	Impersonation and "verification" scams	Be wary of unexpected requests to confirm your identity

In more detail:

• Email only: Expect more spam and phishing. Use filters and be wary of unexpected messages.
• Password: Follow the steps above. Consider it compromised.
• Phone number: Be alert to scam texts and calls, and consider extra security on your cell phone account, such as a PIN or passcode with your carrier if that option exists. If your accounts rely on text-message codes, consider moving them to an authenticator app; our Google Authenticator guide shows how.
• Payment card details: Contact your bank or card issuer using an official number. Ask whether to replace the card and how to monitor the account.
• Social Security number, government ID or similar sensitive details: Follow the FTC's guidance in What To Know About Identity Theft and the checklists at IdentityTheft.gov, and consider a fraud alert or credit freeze with Equifax, Experian and TransUnion. The FTC says a freeze is free, does not affect your credit score, and lasts until you lift it. If someone has already used your information, report it at IdentityTheft.gov.
• Home address and date of birth: These can help criminals impersonate you. Be careful with unexpected requests to verify your identity.

Step 8: Prepare for Follow-Up Scams

After a breach, criminals sometimes contact affected people while pretending to help. Messages may quote real details about you to sound convincing. Treat unexpected emails, calls and texts about the breach, or offers to "fix" it, with caution. Verify by contacting the company via its official website. Never give out passwords, one-time codes or payment details to someone who contacts you first. Scam texts are a common route; see how to spot fake text messages.

"I Have Your Password" Blackmail Emails

One frightening follow-up is an email that shows one of your real passwords and claims the sender hacked your computer or webcam and recorded you. It demands payment, often in Bitcoin, or it will send a video to your contacts. The FTC says this is a scam: the claims about your computer or webcam are "all talk", and you may get one because your email was exposed in a data breach. The password is usually real because it came from that breach.

• Do not pay and do not reply. Delete the message.
• If the password shown is one you still use anywhere, change it there, and consider updating your other passwords too.
• Report the email to the FTC at ReportFraud.ftc.gov.

How to Prevent Future Damage

• Use a unique password for every account, ideally via a password manager. Many managers include a feature that monitors your saved logins against known breaches and alerts you, though the details differ by product and plan.
• Use a separate email address, or an email alias, for less important sign-ups, which limits what a breach can link back to your main account. Some password managers, such as Proton Pass, include aliases; see our password manager comparison.
• Share less. Give only the information a service needs.
• Delete accounts you no longer use.
• Sign up for breach notifications from a reputable service so that you hear about new leaks sooner.

Frequently Asked Questions

Does a breach mean I was hacked?

Not necessarily. It means a service holding your data was compromised. Your own account might be fine if you acted quickly and used unique passwords.

How quickly do I need to act?

As soon as you can, starting with the affected account, your main email and any account that reused the password.

Can I remove my data from a breach?

Generally no, because copies already circulate. You can reduce the harm by changing credentials and limiting future exposure.

Should I change my email address?

Usually not necessary. Strong passwords and 2FA on the account matter more. Consider aliases going forward.

I got an email with my old password demanding Bitcoin. Should I worry?

Not about the threat itself. The FTC says these blackmail emails are a scam and the claims about hacking your webcam are empty. Do not pay. Change that password anywhere you still use it.

Is it safe to use Have I Been Pwned?

It is a well-known, widely used service. Enter your email address only on its official site, which you should type yourself, and never enter your real passwords into unknown tools.

Related Guides

• How to Recover a Hacked Gmail / Google Account
• 10 Signs of a Phishing Email and How to Report It
• Best Free Password Managers: Bitwarden vs Proton Pass
• How to Tell If Your Email Has Been Hacked and What to Do
• How to Spot Fake Text Messages and Delivery Scams (Smishing)

Conclusion

An email in a breach is a signal to tidy up, not to panic. Check the notice is real, find out what leaked, change the affected password and any reused ones, turn on two-factor authentication, and stay alert for scams that follow. The best long-term protection is unique passwords for every account, which turns each future breach from a crisis into a minor inconvenience.