Let's start with a very common mistake. Someone searches "has my email been leaked", clicks the first unfamiliar site that comes up and types in their address, sometimes even their password. It's a bit ironic. Worried about a leak, they've just handed their details to yet another stranger. Checking is the right instinct. Where and how you check matters just as much.
What exactly is a data breach?
A data breach happens when user information stored by a company ends up in the hands of people who shouldn't have it. You don't need to have done anything wrong. A forum you joined years ago, a gaming site or an online shop gets attacked, and email addresses, usernames and sometimes passwords (usually hashed, occasionally, sadly, in plain text) start circulating online.
Your address showing up in a breach does not mean your email account has been hacked. That distinction matters. What usually happens is that your address and the password you used on that site sit together in a list. Attackers then try the same address and password combination on other sites. If you reuse passwords, that's where the real risk begins.
Checking with Have I Been Pwned, step by step
Have I Been Pwned was set up by security researcher Troy Hunt and has been collecting publicly known breaches for years. Using it takes about a minute:
- Type haveibeenpwned.com straight into your browser's address bar. Go to that exact address, not a similar-looking site from the search results.
- Enter your email address in the box on the home page and search.
- A green result means your address doesn't appear in the breaches the site knows about.
- A red result lists the breaches you appear in, when each happened and what kind of data was exposed (email, password, phone number, IP address and so on).
- If you like, sign up for notifications so you're told if your address turns up in a new breach later.
Can I check my password too?
The same site has a "Passwords" section that checks whether a password has appeared in breaches before. The service says it uses a method that doesn't send your full password. If you'd rather be cautious, look at the built-in password check in your password manager or browser; many of them have this kind of warning. And never type a password into a site you don't know. Full stop.
I'm in a breach. What now?
Most people panic when they see the red screen. No need. Work through the steps below in order and you'll close most of the risk in an afternoon.
- Change your password on the breached site. That is, if the account still exists. If you no longer use it, consider closing it.
- Find every place where you used the same password. This is the most tedious part and the most important one. If your email, your bank and your social media are protected by the same password, change them one by one. Start with your email account, because password reset links for everything else go there.
- Turn on two-factor authentication. Even if someone knows your password, they can't log in without the code or the authenticator app on your phone. If it's off on your email account, switch it on today.
- Use a different password for every account. Nobody can remember that many; a password manager makes it manageable.
- Review your email account's security settings. Are there sessions you don't recognise, forwarding rules, or a recovery phone number or address that's been changed? Attackers sometimes add a quiet forwarding rule so nobody notices.
- Be extra careful with incoming email over the next few weeks. Breach lists are also used for phishing campaigns. Don't click links in emails claiming "there's a problem with your account"; go to the company's website by typing the address yourself. If spam picks up, our guide on how to get rid of spam emails can help.
What if my phone number was in the breach too?
Then treat texts and calls with suspicion as well. Don't give a code to anyone who calls claiming to be from your bank or a delivery company. No legitimate organisation will ask you over the phone for a verification code they've sent you.
Why does it matter which data was exposed?
| Exposed data | Main risk | First step |
|---|---|---|
| Email address only | More spam and phishing | Watch your inbox, tighten your filters |
| Email and password | Takeover of other accounts with the same password | Change passwords and turn on two-factor authentication |
| Phone number | Scam calls and text message fraud | Never share codes, don't tap unknown links |
| Name, address, date of birth | Personalised, convincing scams | Verify any request for identity details through an official channel |
How do I lower the risk from here on?
You can't undo a breach. You can make it less likely that the next one affects you. The logic is simple. The more places you give your address to, the more likely it is to appear in a breach one day. Every new sign-up is one more database holding your address.
Our advice is to shrink your address's footprint:
- Keep your main address for your bank, government services, work and accounts you genuinely plan to keep for years.
- Don't hand your permanent address to sites you'll visit once, say to get a discount code, download a report or ask a single question on a forum.
- Close old accounts you no longer use. A closed account won't be part of a future breach (or at least won't contain your current details).
That second point is exactly what Geçici Mail is for. Open the page and a random address is created; we don't ask you to register. You receive the verification email, you're done, the address goes out of use within a few hours and incoming messages are deleted after 24 hours. If that site gets breached tomorrow, the list will contain an address that stopped mattering long ago, not your permanent one.
One caveat, though. If you forget the password for an account you opened with a temporary address, the reset email goes to that address. If you saved your recovery key you can get back to it; we explain how in our recovery key guide. Even so, opening a valuable, long-term account with a temporary address isn't a good idea.
FAQ
Is Have I Been Pwned trustworthy?
Have I Been Pwned has been collecting publicly known data breaches for years and is widely used in the security community. To check an address you only enter your email; it doesn't ask for a password.
If my email shows up in a breach, has my account been hacked?
Not necessarily. It shows your address was in a site's leaked database. The real risk comes if you used the password from that site on other accounts as well.
What should I do first after a breach?
Change the password on your email account first, then on any other account that used the same password, and turn on two-factor authentication.
Does a temporary email reduce the risk of data breaches?
Using a temporary address instead of your permanent one for one-off sign-ups reduces the number of databases holding your real address. That lowers the chance of your main address appearing in future breaches.