Your email was in a data breach: what now
If your email was in a data breach, change the password you used on that service and on every account where you reused it, then turn on a second factor. A leaked address alone mostly means more phishing; a leaked password means someone can try it on your other accounts. Have I Been Pwned, run by Troy Hunt since 2013, is a legitimate way to check, but an empty result proves nothing.
What to do when your email is in a data breach
Start with what leaked, not with the alert. If a password leaked, change it on that service and everywhere you used it; if only your address leaked, there is nothing to change, but expect more phishing. This is the first case in responding to a breach or a hacked account, and the UK’s NCSC gives the same advice in its guidance on data breaches.
The notice usually comes from the company itself, by email or letter, or from a service that collects leaked data, such as Have I Been Pwned. The NCSC notes that similar checks are often built into antivirus software and password managers. Whatever the source, the notice should say what was exposed, and that decides your next step.
What to change, depending on what leaked
| What leaked | What it allows | What to do |
|---|---|---|
| Email address only | More spam and phishing aimed at you | Nothing to change; be wary of unexpected messages |
| Password | Attempts to sign in to your other accounts with it | Change it on that service and wherever you reused it; turn on a second factor |
| Phone number | Scam texts and calls | Be wary of messages that mention the breach |
| Name, home address, date of birth | More convincing scams | Watch your mail and your credit report |
| Card number | Fraudulent payments | Call your bank or card issuer |
| Social Security, Social Insurance, or other national ID number | Credit opened in your name | Protect your credit file (see below) |
The next hour
- Confirm the breach with the company. Type its address or open its app; the NCSC warns against using the links or contact details in the messages you received.
- Change the leaked password, then every account where you used it, starting with your email. A password manager makes a different password for each account realistic.
- Turn on a second factor on that account and on your email.
- Expect follow-up scams. Criminals use breach news to make their messages look legitimate. The NCSC lists messages about password resets, compensation, or device scans, sometimes sent long after the breach is made public.
Is Have I Been Pwned legit?
Yes. Have I Been Pwned (HIBP) has been run by Troy Hunt since 2013 and describes itself as independently owned. The NCSC names it among the online tools for checking whether your data was in a breach. A few points from its FAQs help you read a result:
- It does not log searches, according to HIBP, and it loads no passwords alongside the addresses it holds.
- An empty result proves nothing. HIBP holds only a fraction of all breaches.
- Some breaches stay hidden from public searches. HIBP flags 90 breaches as sensitive and shows them only to the verified owner of the address.
- Its alerts come from one address. The free Notify Me service writes only to the address being monitored, and every HIBP email comes from noreply@haveibeenpwned.com. A “Have I Been Pwned” warning from anywhere else is not from HIBP.
- Partner offers are not part of the check. HIBP displays commercial partners, some only to visitors in the US.
As of November 10, 2026, HIBP’s counter showed 1,049 breached websites and more than 17.8 billion breached addresses. The figure grows with each breach it loads.
Checking a password without giving it away
HIBP’s Pwned Passwords checks whether a password appears in breach data without sending the password itself. Your device hashes it, sends only the first five characters of the hash, and compares the results it gets back locally. The service is free and needs no account. If a password you still use shows up, change it everywhere.
Checking your business domain
A small business can check every address on its domain at once. HIBP first asks you to prove you control the domain, with a DNS record, an email to a predefined address, a file, or a meta tag. Monitoring is free for domains with up to 10 breached addresses; larger domains need a paid subscription.
What the company owes you
The rules depend on the country, and on the company’s size in Australia:
- UK: the organization reports the breach to the data protection regulator within 72 hours where feasible, and tells you without undue delay when the risk to you is high, unless the data was encrypted, for example.
- Canada: under PIPEDA, a business, small or large, notifies you as soon as feasible when the breach creates a real risk of significant harm, and describes the steps you can take.
- Australia: organizations covered by the Privacy Act, including businesses with an annual turnover above A$3 million, notify you and the OAIC when serious harm is likely, with recommended steps.
- US: every state, the District of Columbia, Puerto Rico, and the Virgin Islands have breach notification laws, and the rules vary by state.
When the alert says “dark web”
Some services word the same news differently, and some alerts are fakes. Our page on what a dark web alert really tells you explains how to tell.
When an ID number leaked
If the breach exposed a Social Security, Social Insurance, or other national ID number, follow the identity theft steps for your country, starting with your credit file.
When someone is already inside
If you notice sign-ins or messages you did not make, the breach has turned into a takeover. Start with getting your Google account back or the equivalent steps for your email provider.