The short answer
Go to haveibeenpwned.com and type in your email address. It lists the known breaches that included that address and which kinds of data leaked. Then check your saved passwords with the tool built into your browser or phone:
- Google: passwords.google.com > Password Checkup.
- Apple: the Passwords app (or Settings > Passwords on older iOS) > Security Recommendations.
- Password managers: most have a breach or "watchtower" report.
If anything shows up, follow the steps below. A breach notice is common and fixable, not a reason to panic.
Trustworthy tools to use
| Tool | What it checks | Notes |
|---|---|---|
| Have I Been Pwned | Email addresses and phone numbers in known breaches | Free; you can sign up for alerts on future breaches |
| Pwned Passwords (same site) | Whether a password appears in leaked lists | Checked in a way that never sends the full password |
| Google Password Checkup | Passwords saved in Google Password Manager | Built into Chrome and Android |
| Apple Security Recommendations | Passwords saved in iCloud Keychain | Flags leaked, reused and weak passwords |
| Mozilla Monitor | Email addresses in breaches | Free scan; uses breach data from Have I Been Pwned |
Avoid unknown sites that ask you to type in your password to "check if it was hacked". That is a classic phishing trick.
Reading the results
A breach result tells you which company lost data, when, and what was taken. The data types matter more than the number of breaches:
- Email addresses only: expect more spam and phishing. Low risk on its own.
- Passwords: the important one. Even if they were stored scrambled (hashed), weak ones can be cracked. Change that password everywhere you used it.
- Phone numbers: expect scam calls and texts, and be alert to SIM swap attempts.
- Dates of birth, addresses, ID numbers: these help criminals impersonate you. Be extra careful with calls and emails that quote your details to seem legitimate.
- Card or bank details: contact your bank.
An old breach of a site you no longer use matters mainly if you reused that password somewhere else.
What to do after a breach
- Change the password for the breached service, if you still use it.
- Change it anywhere else you reused it. Criminals use automated "credential stuffing" to try leaked email-and-password pairs on hundreds of sites.
- Use a password manager so every account gets a unique password. Our password manager guide explains how they work.
- Turn on two-factor authentication, especially for email, banking and social media. Passkeys are even stronger where offered; see passkeys explained.
- Watch for targeted phishing. After a breach, scammers send convincing emails that mention the company or your real details.
- Check your bank and card statements for a few months.
- Freeze your credit if identity documents or national ID numbers leaked, in countries where credit bureaus exist. In the US, a freeze with each of the three bureaus is free.
Signs your account is already being misused
- Password-reset emails you did not request.
- Login alerts from unfamiliar places or devices.
- Sent messages or posts you did not write.
- New payment methods, purchases or forwarding rules in your email.
If you see these, follow our guide to recovering a hacked account.
Make future breaches harmless
You cannot stop companies being breached, but you can limit the damage:
- One password per site, always.
- 2FA on every account that offers it.
- Give out less data. Skip optional fields, and consider email aliases (offered by Apple, some email services and password managers) for shopping sites.
- Sign up for breach alerts on Have I Been Pwned so you hear quickly.
Key takeaways
- Check your email on Have I Been Pwned and your saved passwords with Google or Apple's built-in tools.
- Leaked passwords are the priority: change them wherever they were reused.
- Two-factor authentication makes a leaked password far less useful.
- Expect targeted phishing after a breach and verify any message that quotes your details.