How to Check If Your Email or Passwords Were in a Data Breach (and What to Do Next)

Why breaches matter even if the site was not important

Many people shrug when they hear that an old forum or shopping site lost its data. The risk is not the site itself but the password that you used there. If it also unlocks your email, your cloud storage or your accounting software, the old breach has become a key to your current business.

Criminals trade and share leaked data, then run automated tools that test email and password combinations on popular services. This is called credential stuffing, and it works because many people reuse passwords. Checking regularly tells you whether your details are in circulation and lets you act before someone else does.

Ways to check

Several legitimate options exist, and they take only a few minutes. Using more than one gives a fuller picture.

• Search your address on Have I Been Pwned, a long-running notification service run by security researcher Troy Hunt
• Use breach monitoring inside your password manager, which compares your saved logins against known leaks
• Check the security dashboards in your browser or Google and Microsoft accounts, which flag exposed passwords
• Subscribe to notifications so you are told about future breaches that include your address
• For a company domain, verify ownership and use the domain search features some services provide, then review every address found

Reading the results

A result usually lists the breach name, the date and the types of data exposed. Email addresses alone create mostly a phishing risk: expect convincing messages that mention the service. Passwords, especially in plain text or weakly hashed form, are a bigger issue. Other data such as phone numbers, addresses, dates of birth or financial details increases the risk of identity fraud and targeted scams.

Pay attention to the date. A breach from many years ago may involve an account you no longer use, but if you reuse passwords, old leaks can still matter. Try to recall whether you used that password anywhere else, and treat it as compromised everywhere.

What to do if you appear in a breach

Work through these actions in order, starting with the accounts that matter most to your business.

• Change the password on the affected service, using a new unique password from your manager
• Change the same password everywhere else you used it, beginning with email, banking and admin accounts
• Enable multi-factor authentication on those accounts, preferably with an authenticator app or passkey
• Check email for unknown forwarding rules, recovery addresses and recent sign-ins
• Close accounts you no longer need and delete saved payment details
• Watch for phishing, since criminals often use leaked details to make messages convincing

Rolling this out across a team

For a business, run a one-off exercise and then repeat it a few times a year. Ask each employee to check their work address and tell you only whether they found anything, not what they found if they prefer privacy. Provide time and help to change passwords, and make a password manager available so that the next set of passwords is unique.

If you hold a company domain, consider checking all addresses on it. Pay special attention to former employees' addresses that still receive mail, because they might be targets for password reset requests. Make this part of offboarding too.

Myths about breach notifications

One common belief is that a breach notice means your computer was hacked. Usually it does not. It means that a company you dealt with lost data, and your information was in it. Your own device may be perfectly fine, but the leaked password still needs to be replaced.

Another is that changing a password once solves everything. If the same password or a close variation is used elsewhere, attackers will try variations such as adding a number or changing the final character. Use unique, generated passwords instead of tweaking old ones.

A third is that no result means you are safe. Not every breach is publicly known, and services only include incidents that have become available to them. Treat a clean result as good news, not as a guarantee, and keep your defences in place. Multi-factor authentication remains valuable whatever the check shows, because it protects accounts even when a password has leaked without anyone noticing.

Stop the next breach from hurting you

You cannot prevent other companies from being breached, but you can limit the damage. Unique passwords mean a leak affects only one account. Multi-factor authentication means a stolen password alone is not enough. Using email aliases for sign-ups helps you see which service leaked your address and reduces targeted spam. Keep the habit of checking and the effect of each breach shrinks from a crisis to a routine task.