How to Check If Your Email Address Was in a Data Breach

What a Data Breach Actually Means for Your Email

When a company suffers a data breach, the attackers rarely keep what they stole to themselves. Databases of email addresses, passwords, names, phone numbers, and other account details are copied, traded, and eventually published in what security researchers call breach dumps. Over time, individual dumps get merged into enormous combined lists — often called combolists — that circulate freely on forums and file-sharing sites. Your email address does not need to belong to an important account to end up in one. A forum you registered on in 2013, a shopping site you used once, or a service that no longer exists can all be the source. The breach happened on their servers, but the exposure is yours.

The practical danger is not usually the original breach itself but what happens next. Attackers take these lists and run credential stuffing attacks: they try each leaked email-and-password pair against hundreds of other services, betting that people reuse passwords. If your password from a breached pet forum is the same one protecting your primary email account, the forum breach just became an email account takeover. Leaked addresses also feed targeted phishing, since an attacker who knows which services you use can craft far more convincing fake emails. This is why knowing whether — and where — your address has been exposed is genuinely useful rather than just morbid curiosity.

How Breach-Checking Services Work

Breach-checking services solve a straightforward indexing problem. Researchers obtain copies of breach dumps as they surface, verify that the data is genuine, and load the affected email addresses into a searchable database. When you enter your address, the service tells you which known breaches contained it, when each breach occurred, and what categories of data were exposed — passwords, phone numbers, physical addresses, and so on. The most established service, Have I Been Pwned, has catalogued billions of breached accounts across hundreds of incidents and is widely used by both individuals and companies that monitor their own domains.

A reasonable objection is that typing your password into a website to check whether it leaked sounds like a terrible idea — and typed into the wrong site, it would be. Have I Been Pwned's password-checking feature avoids the problem with a technique called k-anonymity. Your browser hashes the password locally, then sends only the first five characters of that hash to the server. The server responds with every leaked hash that begins with those five characters — typically several hundred candidates — and your browser checks for a match locally. The service never sees your password or even enough of the hash to identify it. The full design was documented publicly by the service's creator and has since been adopted by password managers and browsers for their own leak-checking features.

The k-anonymity model behind Pwned Passwords is explained in detail by Troy Hunt, who runs Have I Been Pwned: Troy Hunt — Pwned Passwords and the k-anonymity model ↗

Checking Your Address Step by Step

Start with Have I Been Pwned at haveibeenpwned.com. Enter your email address in the search box and submit it. The result is either reassuringly empty or a chronological list of breaches that included your address, each with a short description of the incident and the data classes exposed. Read the data classes carefully: a breach that leaked only email addresses is an annoyance, while one that leaked passwords or password hashes demands immediate action. Repeat the check for every address you actively use, including old addresses that still forward to you, since accounts registered under them are just as vulnerable.

While you are there, sign up for breach notifications. Have I Been Pwned lets you register an address and will email you when it appears in a newly loaded breach — turning a manual check you might forget into an automatic alert. The notification service verifies that you control the address before enabling alerts, so you cannot subscribe to arbitrary addresses belonging to other people. For most users this one step captures most of the value: breaches are discovered continuously, and the address that is clean today may appear in a dump loaded next month.

Mozilla Monitor (formerly Firefox Monitor) is a solid second option, built on the same underlying breach data. It offers the same address lookup plus ongoing monitoring tied to a free Mozilla account, and it presents results with step-by-step resolution guidance for each breach. Using both services costs nothing and takes minutes. If you own a custom domain, Have I Been Pwned additionally offers domain-wide monitoring, which reports every address at your domain that appears in any breach — useful because guessable addresses like info@ or contact@ accumulate exposure you never see.

You can check your address and read the full explanation of how breach data is handled in the official FAQ: Have I Been Pwned — Frequently Asked Questions ↗

Mozilla's free monitoring service provides continuous alerts and resolution guidance: Mozilla Monitor — free data breach monitoring ↗

What to Do If Your Address Appears in a Breach

First, change the password on the breached service — and, critically, on every other service where you used the same or a similar password. Attackers assume reuse, and variations like adding a digit or an exclamation mark do not defeat automated guessing. The order matters: secure your primary email account first, because it is the recovery mechanism for everything else. An attacker who controls your inbox can reset the passwords on most of your other accounts at will.

Second, stop the reuse problem at its root by generating a unique random password for every account, which in practice means using a password manager. This single change converts future breaches from a cascading emergency into a contained one: a leaked password unlocks exactly one account, and rotating it takes one minute. Where services offer passkeys, prefer them outright. A passkey is a cryptographic credential bound to your device; there is no shared secret sitting in the service's database to leak, so a breach of the service cannot expose anything an attacker could replay against your account. Enable two-factor authentication on anything important that still uses passwords, ideally with an authenticator app rather than SMS.

Third, treat the exposed data realistically. A leaked password can be rotated; a leaked email address cannot. Once your address is in circulation, expect more spam and more convincing phishing indefinitely. Be especially wary of emails that reference the breached service, since attackers use breach lists to send exactly that kind of targeted lure. If the breach exposed payment data, watch your statements and consider replacing the card. If it exposed identity data such as a government ID number, look into the fraud-alert or credit-freeze mechanisms available in your country.

Reducing Future Exposure with Aliases and Disposable Addresses

Everything above is reactive. The proactive version of breach hygiene is limiting how many databases contain your real address in the first place, because an address that was never collected can never be leaked. Email aliases are the tool for services you have an ongoing relationship with: an aliasing provider gives each service its own forwarding address, so a breach exposes only that alias, which you can then disable. The compromised address dies; your real inbox is untouched, and you know exactly who leaked it.

For one-time interactions — downloading a whitepaper, grabbing a discount code, testing a service you will never return to — a disposable address is the cleaner fit. A temporary inbox from a service like PureTempMail exists for minutes or hours, receives the verification email, and then expires along with all of its data. When that service is inevitably breached years later, the dump contains an address that no longer exists and was never connected to you. Data you never handed over is the only data that is guaranteed never to appear in a breach-checking result.

What Not to Do

Never type a password you actually use into an arbitrary "password checker" website. The k-anonymity design described above is what makes Have I Been Pwned's password check safe, and reputable password managers use the same protocol — but a random site with a form asking for your password may simply be harvesting it. If you want to check passwords, do it through Have I Been Pwned directly or through the leak-checking feature built into your password manager or browser, where the check happens against hashed data without transmitting the password itself.

Be equally sceptical of unsolicited emails announcing that you were breached, especially ones that link to a login page or demand payment. Legitimate breach notifications do not ask for your password, and Have I Been Pwned's alerts never ask you to log in to view results. A related scam claims to have compromising material and cites one of your real leaked passwords as proof; the password is real, but it came from an old breach dump, not from access to your devices. Finally, skip paid "dark web scan" products that repackage the same public breach data these free services already give you.

A Realistic Routine

Breach exposure is not a one-time event to fix but a background condition to manage. A sensible routine is short: check your active addresses on Have I Been Pwned, subscribe to notifications there or on Mozilla Monitor, move to unique passwords via a manager, adopt passkeys where offered, and give your real address only to services that genuinely need a long-term way to reach you. Aliases cover the trusted-but-segmented middle ground, and disposable addresses cover everything transient. None of these steps is difficult, and together they turn the next breach headline from a personal emergency into a non-event.

Reducing how many services hold your real address is the best long-term defence. We cover the practical techniques in a companion article: How to protect your email address from spam