What to do if your email was in a data breach
2 min read · Updated October 15, 2026
Do not panic. Secure your email account first by changing its password and turning on two-factor authentication. Then change the password on the breached service and anywhere you reused it, watch for phishing that mentions the breach and consider deleting accounts you no longer use.
Why order matters
Your email inbox is the master key to your online life, because password resets for nearly every other service land there. If an attacker owns your email, they can take over everything else. That is why the recovery plan starts with email, not with the breached site.
What a breach does not mean
A breach does not automatically mean your accounts were accessed. It means information was exposed. Your risk depends on what was leaked and whether you still use the same password anywhere. Learn exactly what was exposed before deciding how much to change.
First, see what was actually exposed
Before you change anything, find out whether your address shows up in known breach records. The free check takes seconds.
Avoid the second wave: scams
After a breach, criminals often send convincing emails that mention the real service. They may claim to be the company, ask you to ‘verify’ your login or offer compensation. Never click links in those messages. Go to the official site by typing its address yourself.
Make the leak harmless
- ✓Use a unique password for every account, stored in a password manager.
- ✓Enable two-factor authentication everywhere that supports it.
- ✓Delete old accounts and unsubscribe from services you do not use.
- ✓Use email aliases for new sign-ups so one leak does not expose your main address.
Step-by-step recovery plan
- 1Check which breach exposed your address and what data it contained.
- 2Change your email account password to a new, long and unique one.
- 3Turn on two-factor authentication on the email account (authenticator app or passkey).
- 4Change the password on the breached service, then on any account that reused that password.
- 5Review recent activity and sign out of unknown sessions.
- 6Be sceptical of messages about the breach, and verify through official channels only.
- 7Set a reminder to re-check your email in a few weeks.
Frequently asked questions
Do I need to change every password?+
Not necessarily. Change the passwords that were exposed, reused or tied to important accounts. If you use unique passwords, the damage stays limited to one service.
Should I freeze my credit?+
Only if sensitive identifiers such as national ID or financial data were exposed. An email address and password alone do not normally require it. Follow the guidance from the affected company or your local authority.
How long should I stay alert?+
Leaked data circulates for years, so keep up good habits permanently, with extra caution for a few months after a new breach.
Stop guessing. Check your email in seconds.
The free Leakill check looks for your email address in known breach records and tells you whether it was exposed. If it was, an optional detailed report lists the incidents, dates, sources, the kinds of data involved and practical next steps. It is a one-off report, not a subscription.
A breach match is a warning signal, not proof that someone has access to your account today. No public database covers every breach, so a clean result lowers risk without guaranteeing safety.