Email Found in a Data Breach? What to Do Next
Seeing your email address in a breach report is alarming, but it does not mean your inbox has been taken over. What matters is which data leaked alongside it. Work through these steps in order, starting with the accounts that can reset all the others.
Find out what was exposed
Breach notices and checking services such as Have I Been Pwned list which data types were involved: only email addresses, or also passwords, phone numbers, addresses or payment details. Your next steps depend on that list.
Be careful with breach warnings that arrive by email. Scammers send fake notices that link to fake login pages. Check on the company’s official site or a service you open yourself.
What to do for each type of data
| Exposed data | Main risk | What to do |
|---|---|---|
| Email address only | More spam and phishing | Watch for scam messages; no password change needed for this alone |
| Password, even encrypted | Account takeover | Change it on that site and anywhere you reused it |
| Phone number | Scam calls and texts | Treat unexpected codes and calls with suspicion |
| Payment details | Fraudulent charges | Contact your bank and watch statements |
| ID numbers | Identity theft | Follow official identity-theft guidance in your country |
Secure your email account first
- Change your email password to a long, unique one. Your inbox can reset most other accounts, so it comes first.
- Turn on 2-Step Verification, preferably with an authenticator app or security key.
- Review recent sign-in activity and sign out devices you do not recognise.
- Check forwarding rules, filters and recovery details for changes you did not make.
- Then change passwords on other accounts that used the same or a similar password.
Stop one leak becoming many
Reused passwords turn one breach into several. A password manager makes unique passwords practical, and many browsers now warn when a saved password appears in a known leak.
Give fewer sites your main address in the first place. For one-time downloads and short tests, a temporary inbox keeps that site out of your main mailbox, so a future breach there exposes nothing you rely on.
Watch for follow-up scams
After a breach, criminals often send messages that mention the breach or include real details from it to seem trustworthy. Do not reply with codes, passwords or payment details, and do not call numbers given in the message. Contact the company through its official website or app.
Open the tool and check the address and timer before sending a message.
Open a temporary inbox