Your data appeared in a breach: how to check your email and secure your accounts

If you receive a breach alert, verify it through the service itself and establish which information was exposed. Then secure the affected account, replace reused passwords and review active sessions and connected apps. Finding your email address in a breach database does not, by itself, prove that somebody is reading your inbox.

This guide separates three situations: a service has reported a breach of its records; somebody has obtained your password; or your account already contains actions you did not perform. Do not wait for a breach-search result if a recovery number has changed or messages have been sent without you. For a work account, involve your organisation’s administrator immediately so the response also covers any centrally managed access.

1. Establish what actually happened

Open the provider’s app or website independently, using your usual bookmark or an address you enter yourself. Avoid starting with an “urgently verify your account” button inside a breach email. In the service’s own notice, look for the affected data types, incident period and requested actions. Save the notice’s address and the date you checked it so you can distinguish a new update from information you have already acted on.

A useful distinction is this: an exposed name and email address increase the risk of convincing scam messages; an exposed password needs replacing wherever it was used; unfamiliar actions inside an account require regaining control of its access methods. Those are different tasks. For example, an email using your real name may look plausible, but knowing your name does not establish that the sender represents the company it claims to speak for.

2. Check your address and interpret the result carefully

Have I Been Pwned lets you check your address against breaches known to the service. An address search does not need your email password. A result records exposure in collected breaches; it does not inspect who is currently signed into your inbox. A clear result is not a guarantee either, because the service does not know about every incident.

Compare the affected service and data description with the provider’s own notice. Our suggested tracking format is simply “service — exposed information — action completed”. Never place passwords, recovery codes or identity documents in public comments, an assistant conversation or an email to somebody offering to check the breach for you. You need a record of your decisions, not another collection of secrets that can be forwarded or misplaced.

3. Check the device and secure your email account

If you suspect your computer was infected after running an unfamiliar programme or command, do not enter new secrets on it. Microsoft recommends clearing malware from a PC before changing its password. For urgent account protection, use another device you trust and investigate the suspect computer separately. If the trigger was a command from a fake CAPTCHA, our ClickFix response guide covers that situation. A successful password change does not establish that the original computer is clean.

Bring your email under your control before recovering accounts that depend on it: password-reset links often arrive there. Google’s recovery guidance includes checking security events, recovery phone numbers and email addresses, and unfamiliar changes. If you can no longer sign in, follow the provider’s official recovery process. An unfamiliar recovery number or address needs correcting, rather than simply being noted as suspicious and left available for another person to use.

4. Replace compromised and reused passwords

The NCSC recommends changing the affected account’s password and the passwords of other accounts using the same one. If your email was compromised, also review dependent services: the inbox may have been used to reset their access. Choose a unique new password. Adding a different digit to the old one is not equivalent to choosing an independent new secret that has not been shared across your accounts.

A practical way to organise this work is to review the entries in your password manager instead of trying to remember dozens of websites. For each service, record whether the password was changed and access was checked. Our password manager guide explains setup and recovery. Keep a working route into the account until you have verified its replacement. This matters particularly when you are also changing phones or moving an authenticator app, when several access changes can otherwise become difficult to track.

5. End unfamiliar sessions separately from changing the password

A session is access already established through a browser or app. Do not assume a new password instantly closes every session. Google lists exceptions: after a password change, access may remain on identity-verification devices, some devices with authorised third-party apps, and connected home devices. Review access separately instead of treating the password-change confirmation as evidence that every other device has been disconnected.

For Google, open Security & sign-in → Your devices → Manage all devices. Review session details, not just the phone’s name: one device can have several sessions. The displayed time can reflect background syncing, and the location may be approximate. An unfamiliar city alone does not explain an event. Sign out of sessions that are not yours or that you cannot confidently recognise; for an unfamiliar device name, check all sessions bearing that name.

A personal Microsoft account offers Sign out everywhere in its advanced security options. Microsoft says completion can take up to 24 hours and excludes Xbox consoles. For Apple, review Devices at account.apple.com and remove unfamiliar entries, following its compromised Apple Account guidance. Interface labels can vary with language and version. These are examples for personal accounts; an organisation may manage sessions through different controls, so its administrator should handle that part of a work-account incident.

6. Review email forwarding and connected-app permissions

In Gmail, check forwarding settings and filters. You can disable forwarding through Settings → See all settings → Forwarding and POP/IMAP, or Forwarding. Save the change, then inspect filters separately because they can also forward selected messages. Changing a password is not a review of where copies of your incoming mail will go. Look for rules you did not create and unfamiliar destination addresses, rather than assuming that receiving mail normally means no copies are leaving the account.

Next, open your Google Account’s linked apps and examine what each is allowed to do. Sign in with Google, an app’s access to account data, and permission for an AI agent to interact with an app are separate connections. Remove the relevant permission: stopping an agent’s access does not disconnect the underlying account link. Afterwards, check which functions you still need and restore only permissions whose purpose you understand.

7. Set up stronger sign-in and a backup recovery route

Where supported, a passkey helps protect against password theft through a lookalike sign-in page. The FIDO Alliance explains that passkeys use cryptographic key pairs for phishing-resistant authentication. They can be synced or bound to a device. Our passkey guide covers selection and recovery. This protects sign-in; access you have already granted still needs checking. Enabling a new authentication method should not replace the session and app review above.

If you use a password, enable two-factor authentication where available and keep a backup way to sign in. Google lets you generate a fresh set of backup codes, invalidating the old set. That is useful if the codes may have been exposed. Keep them somewhere protected that remains accessible without your main phone; do not send them to “support”. Before replacing a device, use our 2FA transfer guide to plan access continuity.

Common questions after checking

I changed my password, but the breach entry remains. Is that normal? Yes. Have I Been Pwned records a historical breach, not the condition of your new password. Also use your completed actions and the account’s own security log to assess what has changed.

Do I need a new email address? An exposed address alone does not establish that replacing it is necessary. First assess whether you control the current account and its recovery methods. If you do need to move, list the services that depend on the old address. Otherwise, security notifications and recovery messages may continue arriving somewhere you no longer monitor, leaving the migration incomplete.

What should I watch afterwards? New security events, changes to recovery methods and messages sent without you. If your account already sent scam messages, the NCSC advises warning your contacts. Record when you regained control so you can explain which earlier messages should not be treated as yours. Keep that record free of passwords and codes; its purpose is to help you follow the incident and communicate clearly.

A compact checklist for each account

• The alert was verified through the official service and the exposed information is understood.
• The device used for account changes is trusted, and the new password is unique.
• Sessions, devices, email forwarding and connected apps have been reviewed.
• Recovery addresses and numbers belong to you; 2FA or a passkey and a backup sign-in route are available.
• Changes are recorded without including secrets, and unfamiliar activity is being monitored.