How to Check If Your Data Was in a Breach Before the Scammers Find It First

Check your data breach exposure before someone else uses it

Every week brings another breach notice, and most of them come from companies you barely remember dealing with. A toilet paper brand, a bank you never joined, an airline you flew once. The pattern is the same every time: your data was sitting in a system you never chose, and now it belongs to someone else.

The good news is that checking your own exposure takes about ten minutes and costs nothing. The bad news is that most people only do it after the phishing emails start. Here is the faster way, and what to do with the results.

Step 1: Check your email against known breaches

Start with Have I Been Pwned, the free service run by security researcher Troy Hunt. Type in your email address and it tells you which public breaches contain it, and what kind of data each one exposed. It covers billions of records from breaches like the Arara incident that exposed 77 million email addresses.

Check every email address you use, not just your main one. Old addresses from university, previous jobs, and long-forgotten signups are usually the ones that show up. If an address appears in a breach, note what was exposed. An email alone is a spam risk. An email plus a password is a break-in risk. An email plus a phone number plus a home address is a phishing kit.

Google and Apple both run their own versions of this check. Google's Password Checkup, inside your Google account security settings, flags passwords that appeared in known breaches. Apple's iCloud Keychain does the same on iPhone and Mac, under Settings, then Passwords, then Security Recommendations. Use whichever one matches the accounts you actually live in. The results overlap but neither catches everything, so running two checks is worth the extra two minutes.

Step 2: Treat a hit as a to-do list, not a panic

Finding your email in a breach is normal. Most people who have used the internet for a decade will show up in several. What matters is what was exposed and whether you still use that password anywhere.

Work through the hits in this order. First, any breach that exposed a password you still use. Change that password everywhere it appears, starting with your email account itself, because email is the reset key for everything else. Use a password manager to generate a unique replacement. Reusing one password across sites is the single habit that turns a small breach into a big one.

Second, turn on two-factor authentication for your email, banking, and social accounts. An authenticator app is better than SMS codes, but SMS is far better than nothing. If a service offers passkeys, use them. Passkeys cannot be phished the way passwords can, and they are now supported across Google, Apple, and Microsoft accounts.

Third, close the accounts you no longer use. Every dormant account is a breach waiting to happen, and you will not notice when it does. Our guide to deleting old online accounts walks through the process, starting with the accounts most likely to hold payment details.

Step 3: Expect the phishing that follows a breach

Breaches have a second wave, and it arrives by email and text. Criminals buy or trade breach data, then send messages that use your real details to look legitimate. A message that knows your name, your address, and roughly what you spent is easy to trust. That is the point.

The defense is boring and it works. Never click a link in an unexpected message about your account, your order, or your subscription. Navigate to the site yourself or open the app. Treat any message that creates urgency, a locked account, a failed delivery, a refund, as suspicious until proven otherwise. Our guide on how to spot a phishing email covers the specific tells, from sender addresses to the pressure tactics that show up again and again.

One more check worth doing: search your own name and email address in your inbox for breach notification emails you ignored. Companies are required to notify affected customers in most jurisdictions, but those emails look exactly like phishing, so many people delete them. If a company you use has notified you about a breach, take it seriously even if the notice arrived months ago.

Make this a habit, not a one-time cleanup

Set a calendar reminder to re-check your main email addresses every three months. Have I Been Pwned also offers a free notification service that emails you when your address appears in a new breach. Turn it on and let the alerts come to you.

The uncomfortable truth is that you cannot prevent your data from appearing in breaches. You do not control the vendors, the marketing platforms, or the reservation systems that hold it. What you can control is how much damage a breach does. Unique passwords, two-factor authentication, and a habit of checking exposure turn a breach notice from a crisis into a ten-minute chore. Do the ten minutes now, before the scammers do their part.