How to Check If Your Email Was Breached (and What to Do Next)

Go to haveibeenpwned.com, enter your email, and read the list of breaches it returns. Each entry shows the breached service, the date, and — most importantly — what data leaked:

• Email addresses only: annoying (spam lists), harmless to your security.
• Passwords: serious if you reused that password anywhere — which, statistically, you did.
• Security questions, partial card data, phone numbers: fuel for phishing and SIM-swap attacks; adjust behavior accordingly.

Also run the Dark Web Report in your Google account (or Norton/other identity tools) as a second source — coverage differs slightly between services.

Three patterns cover 95% of results:

• One or two old breaches (5+ years), password listed, no recent activity: classic stale exposure. If you have since changed passwords and never reused the old one, you are fine. Verify with a session audit anyway (Step 3).
• Recent breach (this year) with password: urgent. That password is now in attacker dictionaries. Change it on the breached service and everywhere you reused it — today.
• Many breaches across years: your email is a permanent member of attacker target lists. The fix is not deletion (impossible) — it is making your accounts expensive to attack: unique passwords, 2FA, aliases.

Breach fatigue is real: nearly every email address appears in multiple breaches by now. The goal is not a clean record — it is ensuring no currently valid password of yours is in any of them.

1. Audit active sessions on your email account (Gmail: Security → Your devices; Outlook: Sign-in activity). Sign out anything unrecognized. Email is the master key — secure it first.
2. Change the email account's password to something long and unique (passphrase method), then enable 2FA per our 2FA guide.
3. Change passwords on any breached service — and, critically, everywhere you had reused that password. Attackers run credential-stuffing: your leaked forum password against your bank.
4. Check your password manager's breach report (1Password Watchtower, Bitwarden Data Breach Report, Keeper BreachWatch) — it checks your whole vault against HIBP automatically and flags exactly which entries need rotation.
5. Watch for phishing for 30 days. Breach data powers targeted scams ('from' your leaked service, quoting real details). Trust certificate warnings, type addresses manually, never reset via email links you did not request.

You cannot prevent services from being breached. You can make each breach worthless:

• Unique password per site — via a password manager, non-negotiable (our comparison picks one for every budget).
• Email aliases for signups — SimpleLogin, Hide My Email, or Firefox Relay generate addresses that forward to your real inbox. When the alias's service breaches, the alias dies, not your identity. You also instantly know who leaked.
• 2FA everywhere that matters — a leaked password without its second factor is a dead asset for attackers.
• Monitor on autopilot — HIBP's free notification service emails you when your address appears in future breaches. Two minutes to set up, permanent payoff.

Run this drill once a year after the initial cleanup: check the address, glance at the manager's report, rotate anything flagged. Ten minutes, annually.