How to Check If Your Data Was Leaked — and What to Do in the First Hour
Wondering if your email appeared in a breach? Here's how to check if your data leaked, read the results, and lock things down in the first hour.
Start with Have I Been Pwned
The fastest way to check if your data leaked is Have I Been Pwned, a free service run by security researcher Troy Hunt. Type in your email address and it tells you which known breaches include it, what kind of data was exposed, and when.
A result that says your email appeared in three breaches is normal. Most active email addresses show up in at least one. What matters is what was exposed: an email and password combination is far more serious than an email alone, and a breach that included phone numbers, addresses, or ID numbers deserves faster action.
Check every email address you use, including old ones. Old accounts are the ones people forget, and forgotten accounts with reused passwords are exactly what attackers count on. If you have a separate email for banking or important accounts, check that one first.
Have I Been Pwned also offers a notification service. Sign up and it emails you when your address appears in a new breach. That turns a one-time check into an early warning system, which is the whole point: the sooner you know, the less damage a leak can do.
Read the breach notice you actually got
Companies are required to notify affected people, and those notices usually arrive by email or letter weeks after the breach. They are easy to ignore because they look like spam. Read them anyway, because they tell you specifically what of yours was exposed.
A real breach notice names the company, describes roughly when the breach happened, lists the categories of data involved, and tells you what the company is offering, usually free credit monitoring. It will not ask you to click a link and log in to confirm your identity. If a "breach alert" message asks you to log in, enter payment details, or download an attachment, treat it as phishing. Go to the company's site directly instead.
If you never got a notice but your email shows up in a breach database, that happens too. Notification systems are imperfect, and some breaches are only discovered months later. Trust the database over the absence of a letter.
The first-hour checklist
Once you know your data leaked, work through this in order:
- Change the password on the breached service, and on any other service where you used the same password. Use a password manager to generate a unique one. Reused passwords are how one breach becomes ten.
- Turn on multi-factor authentication on your email, banking, and social accounts. Your email is the master key: anyone who controls it can reset your other passwords.
- Switch to passkeys where available. Passkeys are phishing-resistant and remove the password from the equation entirely. Google, Apple, and Microsoft all support them now.
- Freeze your credit with the major bureaus if financial data was exposed. A freeze blocks new accounts from being opened in your name and costs nothing. You can lift it temporarily when you need credit.
- Watch your statements. Check bank and card activity for small test charges. Attackers often start with a tiny transaction to see if a card works before going bigger.
If sensitive documents like ID numbers or tax information were exposed, file a report with your local fraud reporting service and consider an identity-theft report. The exact process varies by country, but the principle is the same: create a paper trail early.
What not to do
Don't panic-buy identity protection from the first ad you see. Most of what those services sell is monitoring you can get free from your bank, your credit bureau, or Have I Been Pwned notifications. Paid services have their place, but buy them after a calm comparison, not in the first hour.
Don't ignore the breach because "everyone's data is out there anyway." That is partly true and completely unhelpful. The October breach wave showed the same mistakes repeating at national scale, but the people who changed passwords, enabled MFA, and froze credit came out fine. The people who did nothing are the ones who find out months later through a declined loan application.
Finally, don't treat this as a one-time cleanup. Breaches are a permanent feature of modern life. Set up breach notifications, use a password manager, lock down your sensitive conversations, and check your exposure every few months. The goal is not perfect privacy. It is making yourself a harder target than the next account in the leaked database.
