Sooner or later every email address ends up in a breach. A retailer you bought from once is hacked, a forum you joined years ago leaks its user table, a marketing firm you never heard of loses a database that happened to contain you. The notification email, if you get one at all, is usually vague: "some customer information may have been accessed". This guide explains what that actually means, how to find out which of your accounts are affected, and what to do about it, in the order that matters.
What a breach actually exposes
Not all breaches are equal. The damage depends on which fields leaked and how they were stored.
| What leaked | What an attacker can do with it | How urgent |
|---|---|---|
| Email address only | Target you with phishing and spam; confirm the address is real | Low: be more suspicious of mail for a while |
| Email + password (hashed) | Crack weak hashes offline, then try the password on other sites | Medium to high: change that password everywhere it was reused |
| Email + password (plain text) | Log in immediately, anywhere you reused it | High: change passwords today |
| Name, address, phone, date of birth | Identity fraud, convincing targeted phishing, SIM-swap attempts | High: watch credit and phone account |
| Card numbers | Fraudulent purchases until the card is replaced | Immediate: contact the bank |
| Security questions and answers | Reset passwords on other accounts that use the same questions | Medium: change the answers wherever used |
The single most important mechanic to understand is credential stuffing. Attackers take the email and password pairs from one breach and automatically try them on hundreds of other sites: email providers, shops, streaming services, banks. It works because most people reuse passwords. A breach at a small forum becomes a problem for your main email account only if the two share a password.
Step 1: find out what has leaked
The best-known public service for this is Have I Been Pwned, which indexes billions of leaked records and lets you search by email address. It shows which breaches contained your address and which data classes were included in each. Its companion password search lets you check whether a specific password has appeared in any breach, without sending the password itself, by sending only part of a hash.
Most password managers now include a built-in version of this check, and Google, Apple and Microsoft all warn you when a saved password shows up in a known leak. Turn those alerts on. They are the earliest warning you will get.
Search every address you use, including old ones you have abandoned. An old address with an old password is exactly what an attacker will try first against your current accounts.
Step 2: change the right passwords in the right order
- Your email account first. Whoever controls your email can reset every other password. If the leaked password was also your email password, change it before anything else, then check the account for forwarding rules, unfamiliar recovery addresses and unknown logged-in devices.
- Financial accounts and anything with stored payment details. Banks, payment apps, shops with a saved card.
- The breached site itself. It may force this on you, but do it anyway.
- Everywhere else that shared the password. If you cannot remember where you used it, that is the argument for a password manager: it keeps the list for you and can generate a different strong random password for every site.
Choose new passwords that are long and unique. Do not simply increment a number at the end. Attackers know the pattern "Password2025" becomes "Password2026" and try that automatically.
Step 3: add a second factor where it matters
A stolen password is useless against an account that also requires a code from your phone or a hardware key. Enable two-factor authentication on your email, your bank and any account that holds money or personal data. Prefer an authenticator app or a passkey over SMS codes where you have the choice; our comparison of 2FA methods explains why. Store the backup codes somewhere safe; they are what gets you back in if you lose the phone.
Step 4: watch for what comes next
Breached data is sold and resold, and the follow-up attacks can arrive months later. Expect:
- Targeted phishing that uses real details from the breach to look authentic: your name, the product you bought, the last four digits of a card. An email that knows these things is not automatically genuine. Our guide to spotting phishing covers the tells.
- "Sextortion" and threat emails that quote an old password of yours as proof they have hacked your device. They have not; they have a breach dump. Change the password if you still use it anywhere and delete the message.
- Password reset emails you did not request. Each one is an attacker testing whether they can get in. Do not click the link; log in through the site normally and check the account.
- Unusual activity on your phone account if your number leaked. Ask your carrier to add a port-out PIN so the number cannot be moved to another SIM without it.
If personal identifiers such as a national ID number or date of birth leaked, consider a credit freeze or fraud alert with your country's credit bureaus. It is free in many places and stops new credit being opened in your name.
Step 5: reduce how much the next breach can take
You cannot stop companies losing data, but you can decide how much of you they hold.
- Use one unique password per site. This turns every breach into a problem for one account instead of all of them.
- Give throwaway sites a throwaway address. For one-time downloads, trials, and sites you will never return to, a disposable email address means there is nothing of yours in their database to leak. For services you will use again but do not fully trust, an alias that forwards to you works well, and tells you who leaked it.
- Do not store cards where you do not have to. Guest checkout and one-time payment tokens limit what a shop breach can expose.
- Delete accounts you no longer use. Dormant accounts are breached as often as active ones, and you will not notice.
- Answer security questions with random strings stored in your password manager, not with your mother's real maiden name, which is probably in a breach already.
How to read a breach notification
Companies are required in many jurisdictions to notify affected users, but the wording is written by lawyers. "May have been accessed" usually means "was taken". "Encrypted passwords" can mean anything from a modern slow hash, which is good, to an ancient unsalted MD5, which cracks in minutes; treat all of them as compromised. "No evidence of misuse" means they have not seen it yet. The notification should tell you the date of the breach, the data types involved, and what the company is doing; if it does not, assume the worst case for each and act accordingly.
Be careful with the notification itself. Fake breach notices are a phishing tactic in their own right. Do not log in from a link in the email; go to the site directly.