Your Email Was in a Data Breach — Do This Now

Finding your email address in a breach notification is unpleasant but rarely an emergency — if you respond in the right order. The real damage from most breaches doesn't happen on the site that was hacked. It happens weeks later, when attackers replay your leaked email-and-password pair against your bank, your inbox, and every shop you've ever used. This page walks through exactly what to do, ranked by what actually reduces risk.

First: confirm what actually leaked

Before changing anything, find out which breaches your address appears in and what data types were exposed. Your response is different for "email address only" than for "email + password + phone + home address".

• Have I Been Pwned — enter your address at haveibeenpwned.com. It's free, run by a respected security researcher, and lists each breach with the exact data classes exposed (passwords, phone numbers, addresses, and so on). Check every address you use, including old ones.
• Your browser and password manager — Chrome, Edge, Safari, and Firefox all warn about credentials seen in known breaches, as do 1Password, Bitwarden, and other managers. If you've been dismissing those warnings, this is the moment to open the list and work through it.
• Google Password Checkup — go to passwords.google.com and run Checkup to see which passwords saved in your Google account are compromised, reused, or weak.
• Apple and Firefox monitoring — on iPhone/Mac, check Settings → Passwords → Security Recommendations; Firefox surfaces breach alerts for saved logins and through Mozilla's monitoring service.

The 7-step response, in priority order

1. Change the password on the breached site

   Do this first, even if the company says passwords were hashed. Log in directly (not via any emailed link), change the password to something long and unique, and sign out of all other sessions if the site offers it. If you no longer use the service, change the password anyway and then delete the account.

2. Change that password everywhere you reused it

   This is the step that actually matters. Attackers take leaked email-and-password pairs and automatically try them on hundreds of other sites — banks, email providers, shops — a technique called credential stuffing. One reused password turns a minor forum breach into a bank account takeover. Search your memory and your saved passwords for every place that password (or a close variant like password2024!) is in use, and change each one.

3. Move to a password manager and unique passwords

   Reuse is the disease; a breach is just the symptom. Install a password manager (the ones built into iCloud Keychain and Google are fine; Bitwarden and 1Password are solid standalone options), let it generate a unique random password per site, and let its audit feature walk you through replacing your reused ones. After this, any single future breach costs you exactly one password.

4. Turn on two-factor authentication

   Enable 2FA on your email account first — it's the master key to everything else — then on banking, and anywhere money or identity lives. Prefer a passkey or authenticator app (Google Authenticator, Aegis, built-in phone options) over SMS codes: text messages can be intercepted via SIM-swapping, though SMS 2FA is still far better than none.

5. Check your email account for attacker persistence

   If the breached password was also your email password, assume someone may have been inside. Attackers who briefly control a mailbox plant quiet backdoors so they keep receiving your mail after you change the password. Check: in Gmail, Settings → See all settings → Forwarding and POP/IMAP for forwarding addresses you didn't add, and the Filters and Blocked Addresses tab for filters that forward or delete mail; in Outlook, Settings → Mail → Rules and Forwarding. Also review your recovery email and recovery phone number on both — a swapped recovery address lets an attacker reset your password at will. Then sign out all other sessions and review recent login activity.

6. Expect the follow-up scams — and don't pay

   Breach data feeds two predictable scam waves. First, targeted phishing that references the breach ("Your account was compromised — verify your details") and looks credible because it uses real information about you. Second, sextortion emails that quote a real old password of yours and claim to have webcam footage. These are mass-mailed scams built from breach dumps: the password is real, the hack of "your camera" is not. Don't pay, don't reply, don't open attachments. Retire the quoted password if it's still alive anywhere, and delete the message.

7. Decide whether the email address itself should change

   Usually it shouldn't. An exposed address with unique passwords and 2FA behind it is still perfectly usable — expect somewhat more spam, nothing worse. Consider abandoning an address only when it has appeared in many breaches and now attracts constant phishing, or when the exposure makes you a specific target (stalking, a high-value job). If you do move on, see how to delete a Gmail account safely, and set up your next identity with email aliases so one leaked alias never exposes your real address again.

What the leaked data types actually mean

Breach notices and haveibeenpwned.com list "compromised data" classes. Here's how to read them:

• Email address only. The lowest tier. Expect more spam and phishing; no password action is strictly required, but it's a good prompt to check your reuse habits anyway.
• Plaintext passwords. The worst case: the site stored passwords readably, and attackers can use them instantly. Treat every account sharing that password as compromised right now.
• Hashed passwords. The password was stored scrambled. Whether it's crackable depends on the algorithm (bcrypt and Argon2 resist cracking; MD5 and SHA-1 barely slow it down) and on your password's strength — common passwords fall in seconds regardless. You won't usually know the algorithm, so treat the password as burned and change it.
• Phone numbers, addresses, dates of birth. These can't be "changed" like a password. Their risk is impersonation and convincing spear-phishing — and they tend to end up on people-search sites, which is why removing your data from brokers matters after a breach like this.
• Payment card data. Watch statements, and ask your bank for a replacement card. Card networks often reissue proactively after large breaches.

Set up ongoing monitoring

You did the cleanup once; make sure the next breach finds you prepared instead of surprised:

• Subscribe to free breach notifications at haveibeenpwned.com for each address you actively use.
• Leave your browser's and password manager's breach alerts enabled, and act on them the week they appear rather than snoozing them.
• Run Google Password Checkup (passwords.google.com) or your manager's audit report every few months.
• Compartmentalize going forward: with unique aliases per service, a breach tells you exactly who leaked, and killing the alias ends the fallout.

Frequently asked questions