Have I Been Pwned? What to Do If You're Pwned

Last updated: October 29, 2026.

Pwned means your email was found in a known data breach: compromised, not cursed. Have I Been Pwned is a free check, run by security researcher Troy Hunt since 2013. The first thing to do is open each breach and read what leaked. A password, a phone number, and a Social Security number each need a different fix.

Have I Been Pwned's own FAQ puts the rest plainly. Your email being in a breach is an immutable historic fact. It cannot be changed. The goal is to make the leaked data useless.

On October 29, 2026, the homepage listed 1,048 breached sites and 17,846,896,404 pwned accounts. If your address came up red, you are not the exception.

#What does Have I Been Pwned actually tell you?

Type in an email and Have I Been Pwned lists every breach in its database that includes that address: when it happened, and which data types leaked. Common classes are email addresses, passwords, names, phone numbers, and physical addresses.

What it will not show you is the password itself. The FAQ says any ability to send passwords to people would put them at greater risk.

Not every breach is a site you signed up for. Have I Been Pwned's public breach list includes National Public Data, a background-check service. That record is flagged unverified. The listed data classes include names, phone numbers, physical addresses, dates of birth, and government-issued IDs, and the description mentions US Social Security numbers and 134 million unique email addresses.

A fictional example: Dana Mercer, 29, Columbus, Ohio, checked one email and got four breaches (Canva, Dubsmash, MyFitnessPal, and National Public Data). Each one exposed a different mix. That is why the next step is not "change every password and close the tab." It is read the list.

For a wider hour-by-hour playbook that is not tied to this one site, see Your Email Was in a Data Breach: What to Do Now.

#What should I do in the next 10 minutes?

Do these in order. Each one matches a data type, not a feeling.

1. Read what leaked. Open each breach. Note whether it includes a password, a phone number, a home address, a Social Security number, or a card number. Each type has a different fix.
2. Change reused passwords and security questions. If a password leaked, change it on that site and everywhere you used the same one. The FTC's 2018 breach alert also says to change your security questions.
3. Use a password manager, then check Pwned Passwords. Unique passwords stop one leak from unlocking three other accounts. Pwned Passwords uses k-anonymity: only the first five characters of a SHA-1 hash go to the API, never the password. You can run the same private check with our password leak check.
4. Turn on two-factor authentication. A leaked password alone should not be enough to get in. Prefer an authenticator app or a security key over a text-message code.
5. Turn on Notify Me. Notify Me is free. It emails you when your address shows up in a newly indexed breach.

That is the ten-minute block. If the breach also has an SSN or a card number, keep going.

#What if my SSN or card number leaked?

Social Security number. IdentityTheft.gov says to check your credit reports and freeze your credit with all three bureaus. The freeze is free. Pull reports at AnnualCreditReport.com. Freeze Equifax, Experian, and TransUnion separately. Our credit freeze guide walks through all three, plus ChexSystems.

Payment card. The FTC says to request a new card number. If the company offers free credit monitoring, accept it.

Then expect the follow-up. In its Capital One alert, the FTC calls a data breach a magnet for scammers. Emails and calls will pretend to be the company, or the government. Do not click. Do not call the number in the message. Go to the site yourself. The 2018 alert also notes that caller ID can be spoofed.

#Is a clean result proof I'm safe?

No.

Have I Been Pwned's FAQ says the database "contains but a small subset of all the records that have been breached," and quotes the line: "Absence of evidence is not evidence of absence."

A clean result means this collection did not find your address. It does not mean your data was never sold, never leaked, or never copied by a vendor you never heard of.

Keep unique passwords and 2FA anyway. Turn on Notify Me so the next indexed breach does not sit unnoticed.

#What can't a password change fix?

You can change a password in thirty seconds. You cannot easily change your home address. Or your phone number.

We counted Have I Been Pwned's breach list on October 29, 2026. 383 breaches include phone numbers. 309 include physical addresses.

Have I Been Pwned does have an opt-out. The FAQ is clear about the limit: it only hides your email from the site's own search. The breach itself is still out there.

And your address and phone do not just sit in old dumps. People-search sites list them openly for anyone who types your name. That is the part you can erase. See how scammers use data brokers and how to remove personal information from the internet.

Dana's recap, still fictional: new passwords, two-factor, a credit freeze. Then she searched her own name. Her address and number were on six people-search sites.

UndoLeak erases your data from data brokers and keeps it off.

See which people-search sites list your address and phone

#Sources

Accessed October 29, 2026.

1. Have I Been Pwned homepage (1,048 pwned websites, 17,846,896,404 pwned accounts): https://haveibeenpwned.com/
2. Have I Been Pwned FAQs (what pwned means, passwords not sent, small subset, immutable historic fact, opt-out): https://haveibeenpwned.com/FAQs
3. Have I Been Pwned, Who, What and Why (Troy Hunt, running since 2013): https://haveibeenpwned.com/About
4. Have I Been Pwned, Pwned Passwords (k-anonymity, first 5 hash characters): https://haveibeenpwned.com/Passwords
5. Have I Been Pwned, Notify Me (free breach notifications): https://haveibeenpwned.com/NotifyMe
6. Have I Been Pwned breach list API (1,048 breaches; 383 with phone numbers; 309 with physical addresses; National Public Data data classes): https://haveibeenpwned.com/api/v3/breaches
7. IdentityTheft.gov, What to do if your information was part of a data breach: https://www.identitytheft.gov/databreach
8. FTC Consumer Alert, Breaches at Lord and Taylor, Saks, and MyFitnessPal (change password and security questions; new card number; phishing; caller ID): https://consumer.ftc.gov/consumer-alerts/2018/04/breaches-lord-taylor-saks-myfitnesspal
9. FTC Consumer Alert, The Capital One data breach (a data breach is a magnet for scammers): https://consumer.ftc.gov/consumer-alerts/2019/07/capital-one-data-breach-time-check-your-credit-report
10. FTC, What to know about people-search sites that sell your information: https://consumer.ftc.gov/articles/what-know-about-people-search-sites-sell-your-information
11. AnnualCreditReport.com (official free credit reports): https://www.annualcreditreport.com/

---

Dana Mercer and every email, inbox, and screen in the paired video are fictional recreations (example.com address, 555 number), not real people or screenshots. Breach names, dates, and data types are from Have I Been Pwned's public breach list. General information, not legal advice. UndoLeak is not affiliated with Have I Been Pwned or Troy Hunt.