How to Check if Your Email or Password Was in a Data Breach (and What to Do Next)

• Check your email address for free at Have I Been Pwned. It lists the known breaches your address appears in and what data each one exposed.
• Check your saved passwords with Google Password Manager’s Password Checkup (passwords.google.com) or, on iPhone and Mac, the Security section of Apple’s Passwords app. Both flag passwords found in data leaks, plus weak and reused ones.
• Found in a breach? Change that site’s password, change it anywhere you reused it, and turn on two-step verification, starting with your email account.
• If financial data or your Social Security number leaked, the FTC recommends a free credit freeze with all three credit bureaus or a free one-year fraud alert, and step-by-step help at IdentityTheft.gov.
• Not found does not mean safe. Have I Been Pwned only holds breaches that have been made public and loaded into it.

Showing up in a data breach means a company you used lost a copy of your data, such as your email address, a password (often scrambled, sometimes not), your name, phone number or address. It does not mean anyone has logged in to your email. The real risk is that criminals try that leaked email and password on other sites, which only works if you reused the password.

Signs that someone has actually got into your account are different: sent emails you did not write, password reset messages you did not request, or sign-in alerts from places you have never been. If that is happening, follow our 8 steps for a hacked email account first, then come back to this guide.

1. Go to haveibeenpwned.com and type your email address.
2. Read each breach listed: the site name, the date, and the compromised data line (for example email addresses, passwords, phone numbers, dates of birth). This tells you what to change.
3. Repeat for every email address you use, including old ones.
4. Sign up for the free notification service so you get an email if your address appears in a new breach that is loaded later. You have to confirm a link sent to that address, and you can only monitor addresses you control.
5. Check passwords on the separate Pwned Passwords page if you want to know whether a specific password has ever leaked. Its FAQ explains that the password is hashed and anonymized before the search is sent, and that any password found there should no longer be used.

Two things to know about the results. Some breaches are marked sensitive and only show after you verify you own the address. And, in the site’s own words, “absence of evidence is not evidence of absence”: many breaches are never made public, so a clean result is not a guarantee.

If you save passwords in Chrome or on an Android phone, Google checks them for you. Google’s Password Checkup help page describes three results: Exposed (found in a data breach), Weak and Used in multiple accounts.

1. On a computer in Chrome: open the three-dot menu > Passwords and autofill > Google Password Manager > Checkup.
2. In any browser: go to passwords.google.com and select Go to Password Checkup, then Check passwords.
3. Fix the Exposed list first, then Used in multiple accounts, then Weak.

If you save passwords in iCloud Keychain, Apple’s Passwords app flags weak, reused and leaked passwords. Apple’s iPhone guide explains the steps:

1. Open the Passwords app and tap Security. (On iOS 17 and earlier, it is Settings > Passwords > Security Recommendations.)
2. Make sure Detect Compromised Passwords is turned on.
3. Tap each flagged account, then Change Password to update it on the website or in the app. Where a site offers a passkey or Sign in with Apple, consider switching to that.
4. On a Mac, open the Passwords app and click Security in the sidebar.

Work through these in order. The first three take about 20 minutes and block the most common attacks.

1. Secure your email account first. Your email can reset every other password, so give it a new, unique password of at least 12 to 16 characters and turn on two-step verification (an authenticator app or passkey is stronger than text messages).
2. Change the breached site’s password, or delete the account if you no longer use it.
3. Change every account where you reused that password. This is the step that stops credential stuffing, where attackers try leaked logins on other sites. Banking, shopping, social media and anything with a saved card come first.
4. Turn on two-step verification on your bank, Apple Account or Google Account, Amazon and social media accounts.
5. Use a password manager (Google Password Manager, Apple Passwords or another) so every password can be unique without memorizing them.
6. Check your email’s security settings for forwarding rules, recovery phone numbers or recovery emails you do not recognize, and sign out of devices you do not know.
7. Expect targeted phishing. Criminals use breach data to write convincing emails and texts, sometimes quoting your real name or order details. Our guides to spotting phishing emails and what to do after clicking a scam text link help here.
8. If financial or identity data leaked, go to the next section.

Email and password breaches are fixed by changing passwords. Breaches that include your Social Security number, date of birth, or card and bank details need more, and the FTC lays out the steps at IdentityTheft.gov/databreach:

• Credit freeze: free to place and lift, does not affect your credit score, and must be placed separately with Equifax, Experian and TransUnion. You lift it temporarily when you apply for credit.
• Fraud alert: free, lasts one year and can be renewed. Placing it with one bureau is enough because that bureau must tell the other two.
• Credit reports: free at AnnualCreditReport.com. Look for accounts or inquiries you do not recognize.
• Card details: call the card issuer for a new card number and watch statements, because a freeze does not stop charges on existing accounts.
• Free monitoring: if the company that was breached offers free credit monitoring, the FTC suggests taking it.
• Actual fraud: report it at IdentityTheft.gov for a personal recovery plan.

If your email has stopped working properly after a breach, for example it will not sync or keeps asking for the new password on your phone or computer, our Computer & Device Help team can set it up again with you for a fixed price, in a screen sharing session that you start and watch, with a full refund if it is not fixed. Never give your passwords or verification codes to anyone who contacts you first, including people claiming to be from your email provider.