How to Check If Your Email Was in a Data Breach (2026)

Finding your email address in a breach database is unsettling, but it does not automatically mean someone is inside your inbox. It means the address appeared in data exposed by a service. The right response is practical: identify what was exposed, change the affected and reused passwords, secure your email account, turn on stronger sign-in protection, and expect more convincing phishing.

This guide shows how to check if your email was in a data breach and what to do next. It uses Have I Been Pwned (HIBP), a useful public lookup, but no database contains every incident. A clean result is reassuring—not proof that your address has never appeared in an undisclosed, sensitive, or newly discovered breach.

How to check if your email was in a data breach

2026 update: Have I Been Pwned still provides the public email-breach lookup, but its public results do not include breaches marked sensitive or retired. HIBP also offers authenticated dashboard access for features such as sensitive-breach searches and stealer-log information. That means a public “no breaches found” result should be treated as a useful check, not a complete record of every possible exposure.

1. Open Have I Been Pwned by typing the address yourself or using a trusted bookmark.
2. Enter only the email address you want to check.
3. Read the breach names, dates, and exposed-data categories. Do not focus only on the number of results.
4. Use HIBP’s notification option if you want future alerts, then complete the verification email sent to that address.

An email lookup should not require your password, one-time code, recovery key, or full identity details. If a lookalike breach checker asks for any of them, leave it. A breach warning is also a common phishing theme, so do not trust a link merely because it says “security alert.”

What the result means—and what it does not

A breach result means your address was associated with a known exposed dataset. The record may include an email address, username, phone number, password hash, approximate location, or another category of account data. It does not mean every listed category belongs to you, that the password is still valid, or that an attacker can currently sign in.

The date can also be misunderstood. It may refer to when the incident happened, when the data was discovered, or when HIBP added it. Treat the result as a starting point for securing the account, not as a live intrusion report.

Some incidents are sensitive and are not shown in ordinary public searches. HIBP’s notification service can reveal more after you verify control of the email address. That is one reason a clean public result is not a lifetime guarantee.

What to do immediately after a breach alert

1. Change the exposed password—and every reuse of it

Open the affected service by typing its address or using its official app. Do not use a sign-in link from an unexpected breach email. Create a long, unique password and save it in a reputable password manager. Then search the manager for that same password or a recognisable variation and replace it everywhere.

Start with your email account if it shared the password. Email is the recovery key for many other services: whoever controls it may be able to request password resets even when the original breach involved another website.

2. Turn on two-step verification

Enable two-factor authentication wherever it is available. An authenticator app or hardware security key is generally stronger than SMS, although SMS is better than password-only access. Where the service supports passwordless sign-in, our passkey setup guide explains how Google, Apple, Microsoft, and Amazon handle passkeys. Save recovery codes somewhere safe. Never give a code to someone who called, messaged, or emailed claiming to be support.

3. End sessions and inspect account settings

Review recent sign-ins, active devices, recovery addresses, phone numbers, forwarding rules, filters, delegated access, and third-party applications. Sign out devices you do not recognise and remove integrations you no longer use.

For an email account, inspect forwarding and filters carefully. An attacker who created a hidden forwarding rule may continue receiving copies of new messages after you change the password.

4. Prepare for targeted phishing

Exposed data gives criminals context. Expect realistic password-reset messages, fake invoices, delivery notices, account-lock warnings, and requests for one-time codes. Open the company’s website manually, check the account there, and contact support through a published channel.

5. Protect payment and identity information

If the breach involved payment details, identity documents, government identifiers, or financial information, contact the bank or service provider using its official number. Ask what card replacement, monitoring, or fraud-reporting steps apply. Credit-freeze and identity-theft rules differ by country; use your local authority rather than copying advice written for another region.

How to check your Google account for suspicious activity

Open Google Account Security and review recent security events, signed-in devices, recovery details, and third-party access. In Gmail, inspect forwarding rules, filters, delegated access, and unfamiliar sent messages.

If something looks wrong, change the password from the official account page, sign out other sessions, remove unknown access, and follow Google’s recovery guidance. Apply the same review to Apple, Microsoft, banking, shopping, and social accounts—but prioritise your primary email and password manager.

Can you check whether your password was exposed?

Never paste a current password into a random breach form. HIBP’s Pwned Passwords service uses a different, privacy-preserving process from its email lookup: the password is transformed locally and only part of the hash is sent for matching. Use the official service or a reputable password manager, not a form that stores the password for “checking.”

If a password appears in a breach corpus, stop using it—even if the account where you used it has not shown suspicious activity. Password exposure is a reason to replace it, not evidence that someone has already logged in.

What protection fits the data exposed?

How to reduce the chance of another account takeover

• Use a different password for every important account.
• Let a password manager generate and store random passwords.
• Protect email, banking, and password-manager accounts with two-step verification.
• Keep your phone, computer, browser, and apps updated.
• Use bookmarks or manually typed addresses for sign-in pages.
• Review recovery details, forwarding rules, active sessions, and connected apps every few months.
• Delete old accounts when appropriate, but do not assume deletion recalls copies already exposed.

Common questions about email breaches

Does a breach result mean my email account was hacked?

No. It means your address appeared in a known exposed dataset. Your inbox may still be secure, but change reused passwords, enable two-step verification, and review sign-in activity.

Can I remove my email from a breach?

You usually cannot recall copies already distributed. Secure the affected accounts and ask the original service about deletion or privacy options. Removing your address from one company’s system cannot remove copies held elsewhere.

Should I delete the email address?

Usually not. Changing an address is disruptive and does not erase old breach records. Consider a new address only for persistent targeted abuse or when the provider cannot secure the account, and protect the old address while moving important services.

What if I clicked a suspicious breach link?

Close it and do not enter more information. If you entered a password, change it from the official website and replace every reuse. If you entered payment or identity details, contact the relevant provider. Install pending updates and review account sessions.

Sources

• Have I Been Pwned API documentation
• Google: Secure a hacked or compromised account
• Apple: Recognize and avoid phishing and social engineering

Bottom line: A breach alert is a security to-do list, not proof of an active takeover. Change exposed and reused passwords, protect your email account, enable two-step verification, review sessions and forwarding, and treat unexpected follow-up messages as possible phishing.