Data Breach Check: Has My Email Been Hacked? What to Do
6 min read · Updated
If you've had an email address for a few years, it has probably shown up in at least one data breach. That's not a reason to panic. It's a reason to spend twenty minutes closing the doors a breach can open. Here's how to check and what to do next.
What a breach actually exposes
A breach happens when a company's data is stolen or exposed. What leaks depends on the company. It might be just email addresses. It might include passwords, phone numbers, home addresses, birthdates or partial card numbers.
Scammers combine data from many breaches. A leaked email plus an old password lets them try logging in to your other accounts. A leaked phone number plus your name makes a convincing phishing text.
How to check if your email was in a breach
Have I Been Pwned is a free, long-running service that lets you search an email address against known public breaches. It lists which breaches included that address and what kinds of data each one exposed.
Many password managers and some browsers will also warn you about breached or reused passwords.
Also read breach notice letters and emails. Companies are often required to tell you when your data is exposed, and their notice says what leaked. Confirm a notice is real by going to the company's website directly, not by clicking a link in the message.
What to do right away
Work through this list, most important first:
- Change the password for the breached account. Then change it anywhere else you used the same or a similar password.
- Use a password manager so every account gets a long, unique password.
- Turn on two-step verification, or passkeys where offered, for email, banking and social media first.
- Secure your email account above all. Whoever controls your email can reset your other passwords.
- Review account recovery settings: backup email, phone number and security questions.
If more sensitive data leaked
If a breach exposed your Social Security number, financial details or similar data, take extra steps.
- Freeze your credit at all three bureaus: Equifax, Experian and TransUnion. A freeze is free, and it stays in place until you lift it.
- Or place a free fraud alert, which lasts one year. Contacting one bureau is enough; it tells the other two.
- Review bank and card statements for charges you don't recognize.
- Use IdentityTheft.gov. It has a data breach page that explains what to do based on what was exposed.
Watch for the follow-up scams
Breach data fuels targeted phishing. In the weeks after a breach, expect emails or texts that use your real name, mention the breached company, or claim your account is locked.
Don't click links in those messages. Go to the company's site or app yourself. And no legitimate company will ask for your full password or a one-time code by email, text or phone.
Make the next breach matter less
You can't stop companies from being breached. You can limit the damage. Unique passwords mean one breach can't unlock other accounts. Two-step verification means a stolen password alone isn't enough. A credit freeze means stolen details are harder to use for new accounts.
Some people also use a separate email address for shopping and sign-ups, keeping their main address private.
Check again every few months, or set up breach alerts where a service offers them. New breaches come to light all the time, and old ones are sometimes disclosed years later.
A 20-minute breach checklist
If you only have a few minutes, do these in order:
- Search your email address on Have I Been Pwned.
- Change your email password and turn on two-step verification for your email account.
- Change passwords on any breached accounts, and anywhere you reused them.
- Turn on two-step verification for your bank and main social media accounts.
- If sensitive data such as your Social Security number leaked, freeze your credit at all three bureaus.
Where TRUVO360 fits
Every TRUVO360 email check includes data-breach exposure: whether an address appears in known breaches, alongside fraud signals and online footprint. It is useful for your own address and for checking an address someone sent you. Plans are $2.99/month (Basic, 3 searches), $4.99/month (Premium, 10 searches) or $9.99/month (Family, 30 searches shared by 3 accounts).
Free for 5 days, 3 searches, no credit card. Nothing is charged and nothing renews automatically. Paid plans from $2.99/month.
Frequently asked questions
How do I know if my email was in a data breach?
Search your address on Have I Been Pwned, a free service that lists known public breaches. Also watch for breach notices from companies you use, and confirm them on the company website.
What should I do first after a data breach?
Change the breached password and any reused copies of it, then turn on two-step verification, starting with your email account.
Is a credit freeze free?
Yes. Placing and lifting a credit freeze is free at Equifax, Experian and TransUnion. It stays in place until you lift it.
Does TRUVO360 check data breaches?
Yes. Every TRUVO360 email check includes data-breach exposure, along with fraud signals and online footprint.
Sources
Related guides
These guides are general safety information, not legal advice. TRUVO360 is not a consumer reporting agency and does not run background checks. Its results can't be used for employment, housing, lending or insurance decisions.