How to Check if Your Email Has Been in a Data Breach

When a company is hacked, customer email addresses are usually among the stolen data, often with passwords, names or phone numbers. Checking whether your address is in known breaches tells you which accounts need attention.

1. Search Have I Been Pwned

Have I Been Pwned, run by security researcher Troy Hunt, collects data from public breaches. Enter your email address and it lists every known breach that included it, with the date and what kinds of data were exposed. Check every address you use, including old ones.

2. Turn on alerts

• Have I Been Pwned can email you if your address appears in a future breach.
• Mozilla Monitor offers free breach alerts too.
• Password managers such as 1Password and Bitwarden include breach reports for saved accounts.

What a match means

A match means your address was in a breached database, not that your email account itself was hacked. What matters is what else was exposed:

• Passwords: change that password, and any password like it, right away.
• Phone numbers and addresses: expect more convincing scam calls, texts and letters.
• Security questions: change the answers on accounts that use the same ones.
• Just the email address: expect more spam and phishing.

What to do next

1. Secure your email account first, since it can reset every other password: a strong unique password and two-step verification. See two-factor authentication.
2. Check your saved passwords for compromised and reused ones. See checking for leaked passwords.
3. Review account activity on important accounts for logins you don't recognize.
4. Close old accounts you no longer use, so they can't be breached again.
5. Watch for phishing that mentions the breached company. See spotting phishing sites.

Be careful with "dark web scans"

Many companies offer free dark web scans to sell you a product. The reputable free services above cover the same public breach data. Never enter your email password into any checking service; you only ever need your address.

Reduce future exposure

• Email aliases: Apple's Hide My Email, Firefox Relay and SimpleLogin give each site its own address, so a breach exposes only that alias.
• Share less: leave optional fields like birthday and phone number empty.
• Use passkeys where offered; there's no password to leak.

Privacy beyond breaches

Breaches are only one way your data spreads. See a Chrome privacy checklist. Ghost Browser makes random background visits to blur the profile ad trackers build from your browsing; it doesn't affect breaches, so the steps above come first.