How do I check if my data has been in a breach?

Breaches are common and mostly outside your control. What is in your control is whether one leaked password opens several of your accounts, which is why reuse is the real vulnerability rather than the breach itself.

Step by step

1. Check your email addresses on a breach service.Reputable services let you search an address against known breaches. Check every address you use, including old ones.
2. Change the password for any affected account.Immediately, to something unique. If the account is no longer needed, close it properly rather than abandoning it.
3. Change it everywhere else you reused it.This is the crucial step. Attackers take leaked credentials and try them against every major service — reuse is what turns one breach into many.
4. Turn on two-factor authentication.A leaked password alone is then not enough. Prioritise email, banking and anything holding payment details.
5. Prioritise your email account.It is the reset route for everything else. If your email password has been in a breach, treat it as urgent.
6. Start using a password manager.The only practical way to have a different strong password everywhere. It also flags reused and breached passwords for you.
7. Watch for targeted phishing afterwards.Breached data feeds convincing scams — messages quoting real details of yours. Be more suspicious than usual for a while.
8. Check your bank statements if payment data was involved.Small unexplained transactions are often a test before a larger one. Report anything you do not recognise straight away.

Tips

• Set up breach notifications for your addresses so you find out when it happens rather than years later.
• Old, forgotten accounts are a real risk — they hold data and often reuse an old password. Close them rather than ignoring them.
• A breach is not your fault and there is no point in feeling caught out. What matters is not reusing the password.

Questions people ask