Has Your Email Been in a Data Breach? How to Check and What to Do

What you will need: The email addresses you use for work (and any you've used to sign up for business accounts), about 15 minutes, and access to those accounts so you can change passwords.

What a data breach is

A data breach happens when someone gets into a company's systems and copies information it stores about its customers. That might be email addresses, passwords, phone numbers, or home addresses. The breach happens at the company, not on your computer. You can have a strong password and careful habits and still end up in one because a website you signed up for years ago was compromised.

When breached data gets shared or sold online, criminals often try the same email and password combination on other sites, like your email, your bank, or your accounting software. This is called credential stuffing ("credentials" just means your sign-in details). It works when people reuse the same password in more than one place.

Being in a breach doesn't mean your accounts have been hacked. It means some of your information is out there, and it's worth a quick check-up.

Step 1: Check your email address

Have I Been Pwned (haveibeenpwned.com) is a free website that shows which known breaches included an email address. "Pwned" is gaming slang for "owned," meaning compromised.

1. Go to haveibeenpwned.com. Type the address yourself rather than clicking a link in an email or ad.
2. Type one of your email addresses into the search box and search. You never enter a password.
3. Read the result. The site tells you whether it found the address in any breach it knows about and, if it did, lists each one.
4. For each breach listed, look at what data was exposed. Passwords are the most urgent. Email addresses alone are less serious, though they can still lead to more spam and phishing.
5. Repeat for every email address you use, including old ones and shared inboxes like info@ or sales@.

A clean result is good news, but it isn't a guarantee. The site can only report breaches it knows about. If you'd like a heads-up about future breaches, the site also offers an alert you can sign up for with your email address.

Step 2: Change the affected password, and any copies of it

If an address shows up in a breach, assume the password you used on that site is known to others, even if the breach was years ago.

1. Go directly to the site or service that was breached. Type its address yourself or use your own bookmark. Don't click a link in an email.
2. Change your password to a new one you haven't used anywhere else.
3. Think about where else you've used the old password, or something close to it, and change it on each of those accounts too. Start with the ones that matter most:
   • Your email (anyone who controls your email can reset your other passwords)
   • Banking and payment accounts
   • Accounting, payroll, and invoicing software
   • Cloud storage and other business software you sign in to
4. If the breached site is one you no longer use, consider closing the account. Check the site's help pages for how.

Remembering a different strong password for every account isn't realistic, and that's why people reuse them. A password manager creates and stores unique passwords for you, so you only remember one. Our guide Password Managers for Small Teams: What They Do and How to Start explains how to begin.

Step 3: Turn on two-step sign-in

Two-step sign-in (also called two-factor or multi-factor authentication) asks for a second proof of identity, usually a code from your phone, in addition to your password. Even if someone has your password from a breach, they still can't get in without that second step.

1. Start with your email account, since it's the key to your other accounts.
2. Open the account's security settings and look for "two-step verification," "two-factor authentication," or "multi-factor authentication." The name varies by service.
3. Follow the prompts to choose your second step. If you have a choice, an authenticator app (a phone app that shows a short-lived code) or a security key is stronger than codes sent by text message. CISA, the U.S. government's cybersecurity agency, ranks security keys as the strongest option.
4. Save any backup or recovery codes the service gives you somewhere safe, such as your password manager or a locked drawer.
5. Repeat for your banking, accounting, and cloud accounts, plus anything else that offers it.

If your business uses Microsoft 365, our guide How to Turn On Two-Factor Authentication for Microsoft 365 has step-by-step instructions.

Step 4: Watch for targeted phishing

Phishing is a fake message, usually an email, that tries to trick you into clicking a link, opening a file, or handing over information. After a breach, criminals may know which companies you deal with and sometimes your name or other details, so their messages can look more convincing than the usual junk mail.

Be extra careful with messages that:

• Claim to come from a company named in your breach results
• Say your account is locked, suspended, or needs "urgent verification"
• Ask you to confirm a password, payment details, or a one-time code
• Ask for an unusual payment, gift cards, or a change to bank details
• Include an attachment or link you weren't expecting

When in doubt, don't click. Go to the company's website yourself or call a phone number you already trust. Our guide How to Spot a Phishing Email (Before Someone Clicks) walks through the warning signs.

If you did click something or entered your password on a page that seemed wrong, change that password right away from a trusted device, and change it anywhere else you used it.

If more than your email was exposed

If a breach included your Social Security number or financial account details, go further than passwords:

• Visit IdentityTheft.gov, the Federal Trade Commission's site, for a step-by-step recovery plan.
• Consider a credit freeze with each of the three credit bureaus. A freeze stops new accounts being opened in your name, and placing one is free.
• Watch your bank and card statements for charges you don't recognize.

Do you need to pay for monitoring?

You don't need a paid "dark web monitoring" service to take the steps in this guide. Checking your addresses, using unique passwords, turning on two-step sign-in, and staying alert to phishing cover the basics. Be wary of ads or emails that use fear of a breach to sell you something.

A simple routine to keep

• Re-check your email addresses every so often, and any time you hear about a breach at a company you use.
• Use a different password for every account.
• Turn on two-step sign-in wherever it's offered.
• Ask anyone who shares your business accounts to do the same.

If a business account has actually been taken over, or you've lost money to fraud, report it at ReportFraud.ftc.gov, or for cybercrime such as a hacked business email, the FBI's Internet Crime Complaint Center at ic3.gov. If money was sent, call your bank right away.