Your Email Was in a Data Breach: What to Do Now

Last checked: Oct 12, 2026.

You got an alert from your password manager, your bank or a breach-checking site: your email address showed up in a data breach. Take a breath. On its own, an exposed email address is common and usually low-risk. What matters is what else leaked with it. This guide helps you figure that out and tells you what to do in the right order.

#First: what does "your email was in a breach" actually mean?

It means a company you had an account with, or one that bought your data, lost a database that included your email address. Depending on the breach, the same record might also contain:

Breach-checking sites like Have I Been Pwned (haveibeenpwned.com) list which breaches your address appeared in and which data types each one exposed. Look up the breach by name to see what was in it.

#The first hour: passwords

1. Change the password on the breached account if it still exists (FTC).
2. Change it anywhere you reused that password. This is the most important step. Attackers take leaked email-password pairs and try them on banks, email providers and shopping sites.
3. Secure your email account first. Your inbox can reset every other password, so give it a long, unique password and turn on two-factor authentication.
4. Turn on two-factor authentication (2FA) on important accounts. An authenticator app or security key is stronger than text-message codes (FTC; CISA).
5. Use a password manager so every account gets a unique password and you only have to remember one.

A fictional example: Marcus Hill's email, marcus.hill@example.com, appeared in a 2023 breach of an old photo-printing site. The breach included passwords. Marcus had used the same password for his streaming account and an old shopping account. He changed all three and turned on 2FA for his email, which took 25 minutes. He deleted the photo-printing account entirely.

#The first day: check what else is at risk

If a Social Security number or financial information leaked:

• Freeze your credit at all three bureaus: Equifax, Experian and TransUnion. Freezes are free to place and lift, and you contact each bureau separately (FTC). A freeze stops new lenders from seeing your report, which blocks most new-account fraud. You can lift it temporarily when you apply for credit.
• Or place a fraud alert, which is also free. Placing one with one bureau notifies the other two (FTC).
• Watch your bank and card statements closely, and tell your bank if card numbers were exposed.

If the breached company emailed you: read its notice for what was exposed, and whether it offers free credit monitoring. Go to the company's site directly rather than clicking links in the email, because breach notices get imitated by scammers.

Get a tailored plan. The FTC's IdentityTheft.gov/databreach gives step-by-step advice by type of information exposed.

#The first week: watch for phishing

After a breach, the most common follow-up isn't hacking. It's convincing phishing: messages that use your real name, the company's name, or details from the breach to look legitimate (FTC).

Watch for:

• "Your account has been compromised. Click here to verify."
• Fake refund or "breach compensation" offers.
• Texts or calls claiming to be your bank, using details you'd assume only your bank knows.

The rule: never use the link or phone number in the message. Go to the company's website or app yourself, or call the number on your card.

#Ongoing: watch your credit and your inbox

• Check your credit reports for free at AnnualCreditReport.com, the official site (FTC). Look for accounts or inquiries you don't recognize.
• Turn on breach notifications. Have I Been Pwned's free "Notify me" service emails you if your address shows up in a newly indexed breach.
• If someone uses your information, report it at IdentityTheft.gov to get a recovery plan (FTC).

#How breaches feed people-search sites

This part gets less attention. Data that leaks in breaches or is sold by companies adds to the wider pool of personal data, and people-search sites build their profiles from public records, social media and data bought from other companies (FTC, people-search sites). An email address can become the link that ties your name, phone number and address together into one profile.

That's why it's worth searching your email address in Google once you've secured your accounts. If it turns up on people-search pages:

• Ask Google to remove results showing your email and other contact details with its Results about you tool (our Google guide).
• Opt out of the people-search sites that list you (our Whitepages guide shows the process).
• Our pillar guide covers the rest: how to remove your personal information from the internet.

#Reduce the damage next time

You can't stop companies from being breached, but you can limit what each breach exposes:

• Use email aliases for shopping and sign-ups. Apple, Firefox and many email providers offer masked or alias addresses, so a breach at one store exposes an address you can turn off.
• Close accounts you no longer use. A dead account can still leak.
• Give less. Skip optional fields like birthday and phone number.
• Unique passwords everywhere, so one breach can't unlock other accounts.

#A quick checklist

• Look up which breach and what data types leaked
• Change the breached password and every reused copy
• Secure your email with a unique password + 2FA
• 2FA on bank, phone carrier and main shopping accounts
• SSN or financial data leaked? Freeze credit at all 3 bureaus
• Ignore links in breach-related emails and texts
• Turn on breach alerts
• Check annualcreditreport.com
• Search your email in Google; remove people-search listings

#Sources

1. FTC Consumer Alert, "Have you been affected by a data breach? Read on." https://consumer.ftc.gov/consumer-alerts/2022/10/have-you-been-affected-data-breach-read
2. IdentityTheft.gov, data breach guidance. https://www.identitytheft.gov/databreach
3. FTC, "Credit Freezes and Fraud Alerts." https://consumer.ftc.gov/articles/credit-freezes-and-fraud-alerts
4. FTC, "How to Recognize and Avoid Phishing Scams." https://consumer.ftc.gov/articles/how-recognize-and-avoid-phishing-scams
5. FTC, "Free Credit Reports" (AnnualCreditReport.com). https://consumer.ftc.gov/articles/free-credit-reports
6. CISA, "More than a Password" (multifactor authentication). https://www.cisa.gov/MFA
7. Have I Been Pwned. https://haveibeenpwned.com/
8. FTC, "What To Know About People Search Sites That Sell Your Information." https://consumer.ftc.gov/articles/what-know-about-people-search-sites-sell-your-information

Marcus Hill and his details are fictional.