Picture this. You get an email that says “We’ve detected suspicious activity on your account.” Your stomach drops. Or you’re reading the news and see that some company you signed up with in 2016 has leaked millions of customer records, and you wonder whether you were one of them.
You probably were. Most people who’ve been online for more than a few years have appeared in at least one breach. Finding out is free and takes about two minutes. What takes more thought is knowing what the result means and what to do about it.
This guide covers both. It’s long on purpose, so you can follow it from start to finish without needing another article. It also covers some changes from the past year, since a few popular checking tools were shut down or changed.
What you’ll learn:
- What a data breach actually is
- The fastest way to check (two minutes)
- A full walkthrough of Have I Been Pwned
- How to read your results
- Other free checkers, and which ones still exist
- How to check a password safely
- Whether paid dark web monitoring is worth it
- How to avoid fake breach checkers and scam emails
- What to do if you’re in a breach, step by step
- What to do for each type of exposed data
- The special case of infostealer malware
- Long-term habits that make future breaches matter less
- A monthly security routine
- For business and domain owners
- Myths worth dropping
- FAQ
What a Data Breach Actually Is
A data breach happens when information that was supposed to be private ends up somewhere it shouldn’t be. It rarely looks like the movies, with a hooded figure typing furiously. It’s usually duller than that:
- A company’s database is misconfigured and sits open on the internet.
- An employee falls for a phishing email or a convincing phone call, and an attacker gets in.
- A software flaw lets an attacker pull records out of a system.
- A third-party vendor gets hacked, and the data of all its customers goes with it.
- Malware on someone’s personal computer quietly copies saved logins and sends them away.
Once the data is out, it tends to travel. It gets sold, traded, posted on forums, or bundled into huge collections that criminals use for automated attacks.
A breach does not mean someone has broken into your accounts. It means information about you was exposed. The risk comes from what was exposed and what someone can do with it. An email address alone is mostly a spam and phishing risk. An email plus a password is much more serious if you reused that password. An email plus your date of birth, address, and ID number is a different category.
Breaches are also constant. A recent example is the March 2026 Aura incident, where an employee was targeted by voice phishing and roughly 900,000 records were stolen, according to Aura’s investigation and confirmation from Have I Been Pwned. Breaches like this happen to companies of every size, every month.
Why Your Email Address Is the Key
Your email is the thread that connects most of your digital life. It’s your username on hundreds of sites, it’s where password reset links go, and it’s how companies identify you. That’s why breach-checking tools search by email address.
It’s also why an email address is worth protecting. If someone controls your inbox, they can click “forgot password” on almost any other account you own. Keep this in mind, because it shapes the priorities later in this guide.
The Fast Version: Check in Two Minutes
If you only have two minutes, do this:
- Go to haveibeenpwned.com (type it yourself, don’t click a link from an email).
- Enter your email address in the search box.
- Read the result.
A green result means the address wasn’t found in the breaches the service knows about. A red result shows a list of breaches that included your address.
Repeat for every email address you’ve used, including old ones, work ones, and the throwaway one from college. Then come back and read the sections on interpreting results, because the answer isn’t always as simple as green or red.
Have I Been Pwned: A Complete Walkthrough
Have I Been Pwned (usually shortened to HIBP) is the standard tool for this job. It was created in 2013 by Australian security researcher Troy Hunt, and today the site describes itself as a data breach search and notification service that covers tens of billions of breached records, including stealer logs.
Step 1: Search your address
Type your email into the search box on the homepage and submit. Results usually appear immediately. You’ll see a list of breaches (company name, date, and what kinds of data were exposed) or a clear message that no breach was found.
Step 2: Understand what “safe” can and can’t mean
A clean result is good news, but it isn’t a guarantee. The tool can only report breaches that have been discovered, obtained, and loaded into its database. Some breaches are never made public. Some are loaded months or years after they happen. One security reference puts it plainly: a no-match result does not prove that an account or password has never been exposed.
Step 3: Sign up for notifications
Searching once only tells you about the past. To hear about future breaches, use the “Notify me” option on the site. You enter your address and then prove you control it through email verification.
This step matters more than people realize. Most breaches are loaded into the database after you’ve already forgotten you signed up for the affected service. Notifications mean you’ll get an email when your address shows up in new data, instead of finding out by accident a year later.
Is it safe to hand over your email for this? The site’s privacy policy describes the notification feature as storing only what’s needed to send alerts, and independent explainers note that a one-off search isn’t logged, and you’re only emailed if you explicitly subscribe. As with any service, read the privacy page yourself if you’re cautious.
Step 4: Check every address you own
Don’t stop at your main email. Check:
- Your primary personal address
- Your work email (be aware of your employer’s policies before signing up for alerts with it)
- Old addresses from Yahoo, Hotmail, AOL, or an ISP
- School or university addresses
- The address you use for shopping and newsletters
- Any address with a different spelling or number variation you once used
If your address has a “plus” tag or is an alias, check the real underlying address too.
Step 5: Look at sensitive breaches
HIBP marks certain breaches as sensitive, such as those from adult sites, where a public listing could cause real harm. These don’t appear in an ordinary public search. They show up only after you verify you control the address through the notification process. If you expect a result and don’t see one, completing verification is how you find out.
Step 6: Save or screenshot the results
Write down which breaches included you and what data was involved. You’ll use this list in the action plan below.
How to Read Your Results
When a breach appears, you’ll see something like: the name of the service, when the breach happened, how many accounts were affected, and data classes exposed. This last part is the most important. Here’s how to think about each kind.
Email addresses only. The mildest case. Expect more spam and phishing. Not an emergency.
Passwords. Treat this seriously. Check how they were stored. If the entry says passwords were stored as strong hashes, they’re harder to crack, but weak ones can still be cracked. If they were stored in plain text, assume anyone can read them. Either way, change the password on that site and anywhere you reused it.
Usernames and IP addresses. Useful to attackers for tracking and targeting you, but low risk on their own.
Names, phone numbers, physical addresses. This is the raw material for convincing scams. Someone who knows your name, number, and a service you use can sound very believable on the phone.
Dates of birth. A key identity detail. It can’t be changed, so be extra careful about verification calls and messages.
Government IDs, tax numbers, or financial account details. The serious tier. Move to the identity-protection steps in section 10.
Security questions and answers. If these were exposed, change them wherever you used the same answers, and stop using real answers to those questions.
Health or sensitive personal data. Be alert for targeted scams and extortion attempts that reference private details.
How old is the breach?
A 2012 breach that exposed an old password matters only if you still use that password or a close variant. A recent breach deserves quick action because the data is fresh and actively traded.
Did you use that service at all?
Sometimes you’ll see a breach for a company you barely remember. That’s normal. It might have been a one-time signup, an app you tried, or a data aggregator you never interacted with. You can still be in it.
Other Free Checkers (and What Changed)
HIBP is the best-known option, but it’s not the only way to check, and the landscape shifted recently.
Mozilla Monitor
Mozilla’s breach alert tool is free and powered by data from Have I Been Pwned. Mozilla shut down its paid data-removal add-on, Monitor Plus, on December 17, 2025, but the free breach monitoring continues and now supports up to 20 email addresses per user. If you have several addresses to watch and prefer a dashboard with guidance on what to do, it’s worth setting up alongside or instead of HIBP.
Google’s Dark Web Report is gone
If you relied on Google for breach alerts, note that Google discontinued its Dark Web Report on February 16, 2026. Google said feedback showed the tool didn’t give people helpful next steps after an alert. Google’s Security Checkup, password tools, passkeys, and two-step verification still exist, but none of them actively scan dark web breach dumps for you. So if you used to rely on that report, you now need a different monitor. Setting up HIBP or Mozilla Monitor notifications fills that gap.
Your browser’s built-in password check
Chrome, Edge, Firefox, and Safari all have features that compare your saved passwords against known leaked credentials and warn you about reused or weak ones. These are valuable because they check passwords, not just emails, and they work quietly in the background. Find them in your browser’s password manager or the Passwords section of your system settings.
Your password manager’s watchdog
Dedicated password managers such as Bitwarden, 1Password, and Proton Pass include breach monitoring and reused-password reports. If you use one, turn these features on. They combine “your email was exposed” with “and here’s the specific account where you used a compromised password,” which is the most actionable form of alert.
Which should you use?
For most people, a sensible setup is:
- HIBP notifications for every email address you own.
- Your password manager’s breach and reuse reports.
- Your browser’s saved-password warnings, if you don’t use a password manager.
You don’t need five overlapping tools. Pick two or three and actually respond to their alerts.
Checking a Password Safely
Many people worry about typing a password into a website to check it. That’s a reasonable worry, and the way good services handle it is clever.
HIBP’s Pwned Passwords tool uses a technique called k-anonymity. Here’s the idea in plain language: your password is turned into a scrambled fingerprint (a hash) on your own device, and only the first five characters of that fingerprint are sent. The service replies with a list of all the leaked-password fingerprints that start with those five characters, and your device checks locally whether yours is in the list. As one description explains, a client sends only the first five characters of a SHA-1 password hash and gets back matching hash suffixes with occurrence counts. Your actual password never leaves your device.
Even so, a good rule is: don’t type a password you currently use into any website’s checker. Use your password manager’s built-in check, or check a password you’re about to stop using. If a password you rely on comes back as exposed many times, change it regardless.
Also remember the tool works in one direction. It tells you whether a password is known to be compromised. It can’t show you what password was tied to your email in a breach.
Is Paid Dark Web Monitoring Worth It?
Plenty of security suites and identity-protection services sell “dark web monitoring” as part of a subscription. Should you pay?
What it does: scans breach databases and criminal marketplaces for your email, phone number, ID numbers, and sometimes bank or card details, then alerts you.
What it doesn’t do: erase your data from the internet, prevent breaches, or stop criminals from using what they already have. As one consumer-security write-up put it, such alerts show exposure at one moment in time but don’t track ongoing misuse.
When it can be worth it:
- You want monitoring for more than email, such as Social Security-type numbers, passports, or bank accounts, and a bundled service includes it.
- The subscription also gives you something you’d use anyway, like a VPN, credit monitoring in your country, or identity-theft restoration help.
- You’re a higher-risk target (public profile, handling sensitive data, previously a victim of fraud).
When it’s probably not worth it:
- You’d only be paying for email breach alerts, which HIBP and Mozilla Monitor already do for free.
- You wouldn’t change your habits based on the alerts.
A fair summary: free monitoring plus strong habits covers most people. Paid services add convenience and broader scanning, not magic.
Beware Fake Breach Checkers and Scam Emails
Whenever breaches are in the news, scammers take advantage. Watch for these.
Fake checker websites. Some sites imitate breach checkers and ask for far more than an email, such as your password, card number, or phone number, to “verify” your results. A legitimate breach checker never needs your password, your card, or your ID number. Stick to services you’ve verified and reach them by typing the address yourself.
“Your email was found in a breach” emails. If you receive an unprompted message claiming you’ve been breached and telling you to click a link and log in, treat it as phishing. Don’t click. Open your browser, go to the company’s website directly, and check there. Or open the company’s official app.
Extortion emails. Some messages claim to have hacked your device and quote an old password of yours as “proof.” That password almost certainly came from an old breach, not from them watching you. If you see an old password quoted back to you, it’s a sign that credential was exposed. Change it everywhere it was used, and don’t pay.
Calls and texts after a known breach. If a breach exposed your phone number and name, expect “bank” or “support” calls. Hang up and call the number on the back of your card or the company’s official website.
A simple rule covers most of this: never act on an alert by clicking the link inside it. Go to the source yourself.
What to Do If You’re in a Breach: A Step-by-Step Action Plan
Found your address in one or more breaches? Don’t panic. Work through this in order. Most of it takes under an hour.
Priority 1: Secure your email account first
Your inbox is the master key. Before anything else:
- Change your email password to a long, unique one (a passphrase of several random words works well).
- Turn on two-factor authentication, preferably with an authenticator app or a passkey instead of SMS.
- Review recovery options: remove old phone numbers and backup emails you no longer control.
- Check for forwarding rules or connected apps you don’t recognize. Attackers sometimes set up silent forwarding.
- Look at recent sign-in activity and sign out of all other sessions.
Priority 2: Change the affected password, and anywhere you reused it
For each breach that exposed passwords:
- Log in to that service (by typing its address yourself) and change the password.
- If you reused that password anywhere else, change it there too. This is where the real damage happens, because attackers run stolen email-and-password pairs against banks, shops, and social media. This is called credential stuffing.
- Use a different, unique password for every account. A password manager makes this realistic.
Start with the accounts that matter most: email, banking, payment apps, shopping accounts with saved cards, and cloud storage. Then work down to the rest.
Priority 3: Turn on two-factor authentication everywhere that matters
Two-factor authentication (2FA) means a stolen password alone isn’t enough. Rank your options from strongest to weakest:
- Passkeys or hardware security keys. Resistant to phishing.
- Authenticator apps that generate time-based codes.
- SMS codes. Better than nothing, but vulnerable to SIM-swapping, where someone tricks a carrier into moving your number.
Enable the strongest option each site offers.
Priority 4: Check your financial accounts
If a breach exposed financial data, or if you just want peace of mind:
- Look through recent bank and card statements for unfamiliar charges.
- Turn on transaction alerts in your banking app.
- If card details were exposed, ask your bank to replace the card.
- Be cautious with any “fraud department” call. Hang up and call back using an official number.
Priority 5: Consider identity-protection steps (if ID numbers or similar data were exposed)
If government ID numbers, tax numbers, or similar details were part of a breach, you may want to:
- Freeze your credit file where your country offers it. In the US, this is free and done separately with each credit bureau. Other countries have equivalents or different tools, so check your national consumer-protection or data-protection authority.
- Place a fraud alert if a freeze isn’t available.
- Watch for letters about accounts or loans you didn’t open.
- Report suspected identity theft to the relevant government agency in your country.
Laws and options differ widely by country, so look up the official guidance where you live rather than relying on generic advice.
Priority 6: Delete accounts you no longer use
Every account you keep is data held somewhere that could be breached later. If the breach list included services you forgot about, now is the moment to close them. Look for “delete account” (not just “deactivate”) in the settings or contact the company’s privacy team.
Priority 7: Stay alert for follow-up scams
For the next several months, treat unexpected calls, texts, and emails more skeptically, especially ones referencing your name, address, or a service you actually use. Breach data fuels targeted phishing precisely because it makes the messages believable.
What to Do Based on the Type of Data Exposed
Here’s a quick reference for matching the exposure to the response.
| Data exposed | Main risk | What to do |
| Email only | Spam, phishing | Stay alert; set up notifications |
| Email + password | Account takeover | Change password everywhere it was used; enable 2FA |
| Phone number | SIM-swap, scam calls | Add a carrier PIN or port-out lock; use app-based 2FA |
| Physical address | Targeted scams, mail fraud | Be wary of “delivery” and “official” messages |
| Date of birth | Identity verification abuse | Be stricter with verification calls; consider credit protection |
| Government ID / tax number | Identity theft | Credit freeze or fraud alert; monitor accounts; report fraud |
| Card or bank details | Fraudulent charges | Contact the bank, replace cards, enable alerts |
| Security questions | Account recovery abuse | Change answers; use random answers stored in a password manager |
| Health or sensitive data | Extortion, targeted manipulation | Don’t engage with threats; keep records; seek official guidance |
The Special Case: Stealer Logs and Infostealer Malware
There’s a type of exposure that works differently from a typical company breach. Infostealer malware runs on a person’s own device and quietly copies saved passwords, browser cookies, and sometimes crypto wallet data, then uploads it to the attacker. The collected data is traded as “stealer logs.”
Modern breach services now include this kind of data. HIBP’s own description mentions it aggregates stealer logs among its records and offers stealer log exposure detection.
Why does this matter to you? Because if your address appears in a stealer log, the problem may not be a company’s server at all. It may be your device, or a device you once logged in from. Changing passwords alone won’t help if the malware is still running and will just copy the new one.
If you suspect this:
- Run a full malware scan on every device you use, using reputable security software, and keep your operating system updated.
- Then change passwords, from a device you believe is clean.
- Sign out of all sessions on your important accounts so stolen login cookies stop working.
- Review browser extensions and uninstall any you don’t recognize.
- Avoid pirated software, cracked games, and “free” tools from untrusted sources, which are a common way infostealers spread.
- If it’s a work device, tell your IT team immediately.
Long-Term Habits That Make Future Breaches Matter Less
You can’t stop companies from being breached. You can make sure that when it happens, the damage to you is small. These habits do most of the work.
Use a password manager
This is the single highest-value change for most people. A password manager generates and remembers a unique, strong password for every site, so a breach at one company can’t unlock your other accounts. You remember one strong master password and let the tool handle the rest. Many are free for individuals, including built-in options in browsers and phones.
Use passkeys where available
Passkeys replace passwords with cryptographic keys stored on your device and unlocked with your fingerprint, face, or PIN. There’s no password to steal in a breach. More sites support them every month. Turn them on for your email and major accounts when you can.
Use authenticator apps, not just SMS
As covered above, authenticator apps and passkeys are harder to hijack than text-message codes.
Use email aliases for signups
Many email providers and privacy services let you create an alias for each site, such as a different forwarding address per signup. When one alias starts receiving spam or turns up in a breach, you know exactly which company leaked or sold it, and you can disable just that alias. It also keeps your real inbox out of most breach databases.
Share less data in the first place
Companies can’t leak what they never had. When a form asks for a date of birth, phone number, or address that isn’t truly required, leave it blank or skip the signup. Ask yourself whether you need an account at all, or whether guest checkout will do.
Keep software updated
Many attacks use known flaws that already have fixes available. Turn on automatic updates for your operating system, browser, and apps.
Lock down your phone number
Ask your mobile carrier about a port-out PIN or SIM lock, which makes it harder for someone to hijack your number.
Back up what matters
Not directly breach-related, but if an attacker locks you out or wipes something, a recent backup turns a disaster into an inconvenience.
A Simple Monthly Security Routine
Security works best as a small habit, not a once-a-year panic. Here’s a fifteen-minute monthly routine:
- Check your breach alerts. Did HIBP or Mozilla Monitor email you? Act on anything new.
- Review your password manager’s report for reused, weak, or exposed passwords and fix a few.
- Skim recent activity on your email and primary financial accounts.
- Delete one or two unused accounts you come across.
- Install pending updates on your phone and computer.
- Re-check any new email addresses or aliases you started using.
Once a year, do a bigger sweep: update recovery details, review which apps have access to your accounts, and check that two-factor authentication is still active on everything important.
For Business Owners and Domain Owners
If you run a website or business email, you can monitor the whole domain at once instead of one address at a time. HIBP’s Domain Search lets you identify breached email addresses under your domains, see which breaches they appeared in, and understand the types of data involved. You first have to add and verify your domain to confirm you’re authorized to monitor it, and domain monitoring involves a subscription whose size depends on your domain.
For a small business, a few practical points:
- Make sure every employee uses a password manager and two-factor authentication.
- Tell staff to use unique passwords for work and personal accounts. A breach of a personal site shouldn’t open the company’s tools.
- Have a simple plan for what to do when an employee’s address appears in a breach: reset credentials, review access, and check for suspicious logins.
- If customer data is ever compromised, find out what notification rules apply to you. Many countries legally require you to inform affected people and sometimes regulators within a set time.
Myths Worth Dropping
“I’m not important enough to be targeted.” Most attacks are automated. Criminals don’t choose you personally. Software tries stolen passwords on thousands of sites at once. Everyone is a target of opportunity.
“If I don’t see my email, I’m safe.” Not necessarily. Some breaches are undiscovered, undisclosed, or not yet loaded into any database.
“Being in a breach means I was hacked.” No. It means a company holding your data was compromised. Your own accounts may be untouched, especially if you used unique passwords.
“Changing my password once fixes everything.” It fixes that password. If you reused it, or if malware is on your device, you need the broader steps above.
“Antivirus protects me from breaches.” Antivirus helps against malware on your device. It does nothing about a company’s server being compromised.
“Incognito mode or a VPN protects me from breaches.” Neither stops a company from losing the data you gave it.
“Dark web scanning will clean up my data.” It tells you something was found. It doesn’t remove it.
“This is too complicated; I’ll do it later.” The core steps (check your address, use a password manager, turn on 2FA) are not complicated. They just need a Saturday morning.
Frequently Asked Questions
Is it safe to enter my email into Have I Been Pwned?
It’s widely used and trusted in the security community, and a one-time search doesn’t add you to a marketing list. You can read its privacy policy for the details. If you’re extra cautious, you can use a service like Mozilla Monitor, which is built on the same data.
How often should I check?
Set up notifications so you don’t have to remember. Beyond that, a quick check each month, or after any breach in the news that involves a service you use, is plenty.
I’m in dozens of breaches. Is that bad?
It’s common. The number of breaches matters less than what was exposed and whether you’ve reused passwords. Focus on the recent ones and the ones that included passwords or sensitive data.
Will changing my email address help?
Rarely, and it’s a big hassle. A better approach is to secure the address you have, use aliases going forward, and enable 2FA.
Can I get my data removed from a breach list?
Breach notification sites generally keep the record that your address appeared, since that’s how they warn you. Removing yourself from a list doesn’t remove the data from where criminals hold it. Some services allow removal requests, but it rarely changes your actual risk.
Does a breach alert mean I need to cancel my cards?
Only if card or bank details were exposed. If a breach included only an email and a hashed password, you don’t need to replace cards. You do need to change that password and any reused ones.
Should I pay for identity theft protection?
Only if it offers something specific you’d use, such as credit monitoring in your country or help recovering from fraud. For email breach alerts alone, free tools are enough.
What if I get a message threatening to leak my data unless I pay?
Don’t pay and don’t reply. These are usually mass-sent scams using old data. Change any password they quote, enable 2FA, and report the message to your email provider.
What if I can’t remember which sites I used?
Search your inbox for words like “welcome,” “verify your account,” or “confirm your email” to find old signups. Your password manager and browser’s saved logins will also show a lot of them.
Are free email providers less secure than paid ones?
Not inherently. What matters is your password, whether 2FA is on, and whether recovery options are up to date. Major providers all have strong security options available.
Are breaches getting worse?
They’re continuous and large in scale. That’s exactly why the advice in this guide focuses on limiting damage rather than hoping to avoid every breach.
Conclusion
If you take only a handful of things from this guide, take these:
- Check every email address you use on Have I Been Pwned, and sign up for notifications so future breaches don’t surprise you.
- Secure your email account first, because it unlocks everything else.
- Never reuse passwords. Get a password manager and let it do the remembering.
- Turn on two-factor authentication, ideally with an authenticator app or passkey.
- Read the details of each breach to see what was actually exposed, then respond to that rather than to the headline.
- Don’t trust unexpected alerts. Go to the source yourself.
- Make it a habit, not a one-time panic.
Being in a data breach isn’t a personal failure. It’s something that happens to almost everyone who uses the internet. What separates a minor annoyance from a real problem is how prepared you are when it happens: unique passwords, two-factor authentication, a tidy set of accounts, and a habit of checking.
Spend the next thirty minutes on this. Check your addresses, change what needs changing, and set up alerts. Then you can stop wondering and move on with your day.
