Your Email Was in a Data Breach: What to Do Next (Checklist)

By the MailGenerator Team · Updated November 8, 2026

You get an alert from a website, your password manager or a breach-checking service: your email address showed up in a data breach. It's an unsettling message, but in most cases it is very fixable. A breach means a company you used was hacked and some of its customer data leaked. What you need to do depends on what was leaked alongside your email.

Work through this checklist in order. Most people finish it in under an hour.

Step 1: Find out what was exposed

Breach notices usually list the types of data involved. If you only know your address was "found in a breach", look it up on Have I Been Pwned, a free, long-running service that shows which breaches include your address and what was in each one. The categories matter:

• Email address only: low risk. Expect more spam and phishing.
• Email plus password (even "hashed"): high priority. Treat that password as known to attackers.
• Phone number, home address or date of birth: medium risk. Useful to scammers for convincing phishing and phone scams.
• Payment card or bank details: contact your bank today.
• Government ID numbers: highest risk. See step 7.

Step 2: Change the password for the breached site

Go to the site directly (type its address yourself instead of clicking a link in an email) and change your password. Make it long and unique. If you no longer use the account, change the password anyway and then delete the account, so the old data stops sitting there.

Step 3: Change it everywhere you reused it

This is the step that actually protects you. Attackers take leaked email-and-password pairs and try them automatically on email providers, banks, shops and social networks. This is called credential stuffing, and it's the most common way a breach at one small website turns into a hacked email account.

Make a list of every account where you used the same or a similar password, and change each one. Start with the most important:

1. Your email account (whoever controls your email can reset everything else)
2. Banking, payment apps and anywhere with a saved card
3. Your phone carrier account
4. Social media and messaging
5. Shopping and everything else

Step 4: Turn on two-factor authentication

Two-factor authentication (2FA) means a password alone isn't enough to sign in. Turn it on for your email account first, then for banking and social media. Options from strongest to weakest:

• Passkeys or a hardware security key: resistant to phishing.
• An authenticator app (Google Authenticator, Microsoft Authenticator, 2FAS, Aegis and similar).
• SMS codes: better than nothing, but vulnerable to SIM-swap attacks.

Step 5: Check your email account for signs of tampering

If attackers did get into your email, they often leave changes behind so they can keep watching. Check your email settings for:

• Forwarding rules sending copies of your mail to an address you don't recognise
• Filters that automatically delete or archive messages from your bank or from security alerts
• Recovery email and phone number that aren't yours
• Signed-in devices and recent activity you don't recognise (Gmail and Outlook both show these in your account's security page)

Remove anything suspicious, sign out of all other sessions, and change the password again.

Step 6: Expect more phishing for a while

Leaked lists are used for targeted scams. You may get emails that mention the breached company by name, quote your old password, or claim to be from "the security team" offering help. Don't click. Read our guide on how to spot a phishing email and be especially sceptical for the next few months.

A common scare tactic is the "sextortion" email that shows one of your old passwords and claims your webcam was hacked. It's a bluff built from breach data. Don't pay and don't reply; just make sure that password isn't used anywhere anymore.

Step 7: If financial or ID data leaked

• Cards: call your bank using the number on the back of your card and ask for a new card number.
• Bank accounts: ask your bank to watch for unusual activity and set up transaction alerts in your banking app.
• Government ID (SIN, SSN, passport, driver's licence): contact the issuing authority. In Canada you can ask Equifax and TransUnion to add a fraud alert to your credit file. In the US you can freeze your credit for free with Equifax, Experian and TransUnion, and report identity theft at IdentityTheft.gov.

Step 8: Make the next breach matter less

Breaches will keep happening. You can't stop them, but you can limit how much each one hurts:

• Use a password manager so every site gets a different password. Then a leak at one site exposes exactly one account.
• Give fewer sites your real email. For one-time sign-ups, a temporary email means a future leak exposes an inbox that has already expired. For accounts you keep, an email alias lets you switch off just the leaked address.
• Delete accounts you no longer use. Old forgotten accounts are where most people's leaked data comes from.
• Turn on breach alerts. Have I Been Pwned can email you when your address appears in a new breach, and most password managers will flag reused or leaked passwords.

Frequently asked questions

Do I need a new email address?

Usually not. If your address alone leaked, the main effect is extra spam. Changing passwords and turning on 2FA is what protects you. A new address only makes sense if spam becomes unmanageable or the account itself was taken over and you can't fully trust it again.

The breach was years ago. Does it still matter?

Yes, if you still use that password anywhere. Old breach data is combined into large lists that are still used for credential stuffing today.

Is it safe to enter my email on breach-check websites?

Stick to well-known services like Have I Been Pwned or the breach checker built into your password manager or browser. Never enter your password into a site that claims it will check whether it leaked unless it's a trusted tool that explains how it protects it.