How to Check If Your Email Was in a Data Breach (2026 Guide)

The quickest way to check if your email was in a data breach is to enter it at Have I Been Pwned, a free site that lists the known breaches containing that address. Then run the password check built into Google Password Manager or Apple’s Passwords app, and change any password flagged as leaked or reused.

What a data breach actually exposes

A data breach happens when a company’s customer records are stolen or left open online. The leaked file often includes email addresses, names, phone numbers, dates of birth and, in many cases, passwords stored in a weak or crackable form.

Your email address appearing in a breach does not mean your inbox was hacked. It means a service you signed up for lost data that included your address. The real risk comes from what was stolen alongside it, and from reusing the same password on other accounts.

Also readWhat Is UPI Lite Limit in 2026? Wallet, Payment Caps and Setup

Criminals take leaked email and password pairs and try them on banks, shopping sites and social networks. This is called credential stuffing, and it works because many people reuse passwords. Leaked personal details also make phishing messages more convincing, which is why it helps to know how to spot phishing messages before they arrive.

How to check your email on Have I Been Pwned

Have I Been Pwned (HIBP) was set up in 2013 by Australian security researcher Troy Hunt. In October 2026 its homepage showed more than 17 billion breached accounts drawn from over 1,000 breached websites. Searching is free and needs no account.

1. Go to haveibeenpwned.com and type your email address into the search box.
2. Press the search button. A green result means the address was not found in any breach the site holds. A red result lists every breach it appeared in.
3. Read each breach entry. It shows the company, the date of the breach and the types of data exposed, such as passwords, phone numbers or physical addresses.
4. Note which breaches included passwords. Those accounts, and any other account where you used the same password, need attention first.
5. Sign up for the free Notify Me service so you get an email if your address turns up in a future breach.
6. Repeat the search for every email address you use, including old work and university accounts.

Some breaches are marked sensitive, for example those involving adult sites. HIBP hides these from public searches. You only see them after verifying that you own the address through a link sent to that inbox.

HIBP does not store passwords next to email addresses, so a search will not reveal which password leaked. For that, use its separate Pwned Passwords tool, or the password checkers below. HIBP’s own advice is that any password found in its list should no longer be used.

How to use Google Password Checkup

If you save passwords in Chrome or on an Android phone, Google Password Manager can scan them for problems. It flags three types: compromised passwords that have been published online, weak passwords, and passwords reused across more than one account.

1. On a computer, open Chrome and click the three-dot menu at the top right.
2. Choose Passwords and autofill, then Google Password Manager.
3. Click Checkup on the left side of the page.
4. Work through the list, starting with compromised passwords, and change each one on the website concerned.

In another browser, or on a phone, go to passwords.google.com, select Go to Password Checkup, then Check passwords, and sign in to your Google account.

Google previously offered a separate dark web report that scanned for leaked personal details. According to The Hacker News, Google stopped running new scans on 15 January 2026 and retired the feature on 16 February 2026. Google now points users to passkeys and to its Results about you tool, which helps remove personal details from Search.

How to check Apple’s security recommendations on iPhone and Mac

Apple’s Passwords app, built into recent versions of iOS, iPadOS and macOS, includes Password Monitoring. It flags saved passwords that have appeared in known data leaks, as well as weak and reused ones.

1. Open the Passwords app on your iPhone, iPad or Mac.
2. Tap or click Security to see the list of flagged accounts.
3. Open each entry to see whether the password was found in a data leak, is reused or is easy to guess.
4. Use the link to the website to change the password, or set up a passkey if the site offers one.

Apple says the check is designed to protect privacy. Commonly leaked passwords are matched on the device itself. For less common passwords, the device shares only a short fragment of a cryptographic hash with Apple’s servers and completes the comparison locally, so Apple does not see the password.

Is Firefox Monitor still available?

Firefox Monitor now runs under the name Mozilla Monitor, and the free version still works at monitor.mozilla.org. You can run a free scan of known breaches for your email address and sign up for alerts about new ones. The site states that breach monitoring is always free.

What has closed is Monitor Plus, Mozilla’s paid service that tried to remove personal data from data broker websites. Privacy Guides reported in November 2025 that Mozilla would shut it down on 17 December 2025 and offer refunds. The free breach scans and email alerts were not affected.

Quick comparison of free breach checking tools

Tool	What it checks	Cost	Alerts for new breaches
Have I Been Pwned	Email addresses in known breaches, plus a separate password check	Free for individuals	Yes, via Notify Me
Google Password Checkup	Passwords saved in Google Password Manager	Free	Flags appear in Password Manager
Apple Passwords app	Passwords saved on Apple devices	Free	Flags appear under Security
Mozilla Monitor	Email addresses in known breaches	Free	Yes, by email

Details checked on each provider’s official pages in October 2026.

What to do if your email was in a data breach

Finding your address in a breach is common, so there is no need to panic. Work through these steps in order, starting with your most important accounts: email, banking, mobile phone and any account that stores payment cards.

1. Change the breached password. Log in to the affected service and set a new password. If you no longer use the account, change the password and then delete the account.
2. Change every reused copy. Any other account that used the same password is at risk. Give each one a different password.
3. Use a password manager. Google Password Manager, Apple Passwords or a standalone manager can create and store long, unique passwords so you do not have to remember them.
4. Turn on two-factor authentication (2FA). An authenticator app or security key is safer than a text message code, but any second step is better than none. Start with your main email account, since it can reset every other password.
5. Switch to passkeys where offered. A passkey replaces the password with a key stored on your device and unlocked with your fingerprint, face or PIN. Because there is no password to type, it cannot be phished or reused, and a breach of the website does not expose it.
6. Check for signs of misuse. Look at recent login activity, forwarding rules and recovery details in your email account. Review bank and card statements for payments you do not recognize.
7. Be wary of follow-up scams. Criminals often send fake breach warnings or refund offers after a big leak. Go to the company’s site directly rather than clicking links in messages.

Should you freeze your credit in the US?

If a breach exposed your Social Security number, date of birth or financial details, a credit freeze is one of the strongest protections available in the United States. It stops lenders from opening new credit in your name using your credit report.

According to the Federal Trade Commission, a credit freeze is free to place and to lift, and it does not affect your credit score. You need to contact each of the three national credit bureaus separately: Equifax, Experian and TransUnion. The freeze stays in place until you lift it, for example when you apply for a loan.

A fraud alert is a lighter option. An initial fraud alert is free, lasts one year and can be renewed. You only need to contact one bureau, which must tell the other two. Identity theft victims with an FTC identity theft report or police report can get an extended fraud alert that lasts seven years. If someone has already used your details, report it at IdentityTheft.gov to get a recovery plan.

Outside the US, check the advice from your national cyber security or consumer protection agency, as credit reporting rules differ between countries.

How to reduce the damage from future breaches

You cannot stop companies from being breached, but you can limit what a breach costs you. A few habits make a large difference.

• Use a unique password for every account, stored in a password manager.
• Turn on 2FA or passkeys for email, banking, shopping and social media accounts.
• Close accounts you no longer use, so their data is not sitting on old servers.
• Give only the personal details a service actually needs.
• Keep HIBP or Mozilla Monitor alerts switched on, so you hear about new breaches early.

Keeping your apps organized also helps. Our list of the best free productivity apps for 2026 covers tools that can sit alongside a password manager in a simple daily setup.

Frequently asked questions

Sources: Have I Been Pwned FAQs, Google Account Help on Password Checkup, Apple Platform Security on Password Monitoring, FTC on credit freezes and fraud alerts.