What to do if your email address shows up in a data breach

First steps after a breach notification

When you learn your email address has been exposed in a data breach, start by verifying the breach details. Use a free service like Have I Been Pwned to see which sites were involved and what information was compromised. Note that Have I Been Pwned only reflects reported and indexed breaches, so a clean result does not guarantee no exposure. If only your email was leaked, focus on phishing awareness and securing your inbox. If your password was also exposed, change that password immediately on the affected site and anywhere else you used the same credentials.

Consider linking to /assessment/ for a personal exposure check

Change passwords and enable two-factor authentication

Update passwords for all accounts that share the compromised password. Use strong, unique passwords for each account, ideally generated by a password manager. Enable two-factor authentication (2FA) wherever possible, especially on your email account, as it serves as a gateway to other services. 2FA adds an extra layer of security even if your password is stolen.

Watch for phishing and scams

After a breach, cybercriminals may target you with phishing emails that appear to come from legitimate companies. Be cautious of unsolicited messages asking for personal information or urging you to click links. Never share sensitive data via email. If an email seems suspicious, contact the company directly using a known phone number or website.

Consider creating a new primary email

If your email address appears in multiple breaches and you have reused passwords extensively, creating a new primary email address can help you start fresh. Use the new address for sensitive accounts like banking and healthcare, and gradually migrate important accounts. Keep the old address active for a while to catch any important messages, but reduce its use over time.

Monitor your accounts and credit

Even if only your email was exposed, stay vigilant. Monitor your financial accounts for unauthorized transactions and consider placing a free fraud alert or credit freeze with the three major credit bureaus (Equifax, Experian, TransUnion). You can also check your free weekly online credit reports from Equifax, Experian, and TransUnion at AnnualCreditReport.com to spot any suspicious activity. As a separate optional layer beyond these free steps, though no service can prevent all identity theft, paid identity protection services can offer features like real-time alerts and recovery support resources.

For a comparison of paid identity protection services, visit /go/identity.