Big companies get hacked every year, and email addresses are almost always part of what leaks. Knowing whether yours was exposed helps you act before someone uses it against you.
How to check
Have I Been Pwned (haveibeenpwned.com) is a free service run by security researcher Troy Hunt. Type your email address and it lists the known breaches that included it, with the date and the type of data that leaked.
A few things to keep in mind:
- It only knows about breaches that became public. “No results” is good news, not a guarantee.
- You can sign up for a free alert so you hear about future breaches that include your address.
- Many password managers and some browsers offer a similar check built in.
What a leak actually means
The risk depends on what leaked together with your email:
| Leaked with your email | What can happen | How serious |
|---|---|---|
| Nothing else | More spam and phishing | Low |
| Name, phone, address | More convincing scams that use your details | Medium |
| A password (even encrypted) | Criminals try it on other sites, a technique called credential stuffing | High |
| Card or bank details | Fraudulent payments | High: call your bank |
Five steps after a breach
- Change the password on the breached site, and on every other site where you used the same one.
- Turn on two-factor authentication, or a passkey where the site offers one, on your email account first. Your email is the key to resetting every other password.
- Use a password manager so each site gets a different password. Then one breach stays one breach.
- Expect phishing. Emails that mention the breach, or pretend to come from the hacked company, are common right after the news. Go to the website yourself instead of clicking links.
- Watch your bank statements if payment details were involved, and ask your bank about a new card.
In the US, the Federal Trade Commission’s IdentityTheft.gov has a step-by-step recovery plan if your identity was misused. In the UK, you can report fraud to Report Fraud, the national reporting service that replaced Action Fraud.
How to leak less next time
You cannot stop companies from getting hacked. You can control how many of them have your real address.
- Count your accounts. Every forgotten account at a store you used once is one more place your address can leak from. Delete the ones you no longer need.
- Use a temporary email for one-time sign-ups. Coupons, free downloads, Wi-Fi logins and contests do not need your real address. If one of those sites is hacked later, the leaked address no longer exists. Read more in Is temporary email safe and legal?
- Use an email alias for accounts you keep but do not fully trust. Our comparison of temporary email vs. email alias explains which fits when.
Do not use a temporary address for your bank, health services, government accounts or anything you may need to recover later.
Summary
Check your address on Have I Been Pwned, change any reused passwords, and protect your email account with two-factor authentication. Then shrink the problem for the future: give your real address to fewer websites, and use a temporary email for the ones you only need once.
Sources
- Have I Been Pwned, Who, What & Why: the service and who runs it.
- Federal Trade Commission, IdentityTheft.gov: report identity theft and get a recovery plan.
- City of London Police, Report Fraud: the UK’s fraud and cyber crime reporting centre.