Your email was in a data breach. What now?

By Riley Marsh · Last updated November 4, 2026

A leaked email address on its own is common and usually not an emergency. What matters is what leaked with it, and whether you reused that password anywhere.

Check what was exposed

Breach-notification services such as Have I Been Pwned list the breaches an address appears in and what kind of data was taken: email only, or also passwords, phone numbers, addresses, or payment details. The company that was breached may also email you directly.

What to do, in order

1. Change the password for the breached site, if the account still matters to you.
2. Change it everywhere you reused it. Attackers try leaked email and password pairs on other sites within days. This step matters most.
3. Secure your email account first of all. Use a strong, unique password and turn on two-factor authentication. Whoever controls your email can reset everything else.
4. Turn on two-factor authentication on important accounts: bank, shopping, social media.
5. Expect more phishing. Leaked addresses get targeted emails that mention the breached company. See how to spot phishing.
6. If payment details leaked, contact your bank or card provider and watch your statements.

Use a password manager

Password reuse is what turns one breach into many. A password manager creates and remembers a different password for every site, so a leak at one can’t unlock the others.

Keep your real address out of the next breach

You can’t stop companies being breached, but you can limit how many of them have your real address. Use a temporary address for sites you’ll use once, and aliases for accounts you keep. A leaked address that no longer exists, or that you can switch off, can’t be used against you.