---
id: CP-349
slug: have-i-been-pwned-check-email-breach
lang: en
title: Checking if your email was in a data breach
description: A data breach puts your password in circulation. How to react at once, and why an address missing from a database proves nothing.
canonical_url: https://startbrain.io/cyberpedia/en/articles/have-i-been-pwned-check-email-breach/
markdown_url: https://startbrain.io/cyberpedia/en/articles/have-i-been-pwned-check-email-breach.md
publisher: Brain (https://startbrain.io)
license: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/)
cite_as: Brain, "Checking if your email was in a data breach", Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/have-i-been-pwned-check-email-breach/ (CC BY 4.0)
wing: 5
theme: master_passwords
reflex: cr-022
schema: G2
updated: "2026-11-03"
translations:
  en: https://startbrain.io/cyberpedia/en/articles/have-i-been-pwned-check-email-breach/
  fr: https://startbrain.io/cyberpedia/fr/articles/have-i-been-pwned-verifier-fuite-courriel/
  de: https://startbrain.io/cyberpedia/de/articles/have-i-been-pwned-e-mail-adresse-datenleck-pruefen/
  es: https://startbrain.io/cyberpedia/es/articles/have-i-been-pwned-comprobar-filtracion-correo/
sources:
  - "n": 1
    title: Pourquoi et comment bien gérer ses mots de passe ?
    publisher: Cybermalveillance.gouv.fr
    url: https://www.cybermalveillance.gouv.fr/tous-nos-contenus/bonnes-pratiques/mots-de-passe
    published: "2019-11-23"
    accessed: "2026-11-03"
  - "n": 2
    title: NIST Special Publication 800-63B
    publisher: NIST
    url: https://pages.nist.gov/800-63-3/sp800-63b.html
    accessed: "2026-11-03"
  - "n": 3
    title: Use Strong Passwords
    publisher: CISA
    url: https://www.cisa.gov/secure-our-world/use-strong-passwords
    accessed: "2026-11-03"
  - "n": 4
    title: Use a strong and separate password for your email
    publisher: NCSC (UK)
    url: https://www.ncsc.gov.uk/collection/top-tips-for-staying-secure-online/use-a-strong-and-separate-password-for-email
    published: "2018-12-17"
    accessed: "2026-11-03"
  - "n": 5
    title: Les conseils de la CNIL pour un bon mot de passe
    publisher: CNIL
    url: https://www.cnil.fr/fr/les-conseils-de-la-cnil-pour-un-bon-mot-de-passe
    published: "2017-01-26"
    accessed: "2026-11-03"
  - "n": 6
    title: Recognize and Report Phishing
    publisher: CISA
    url: https://www.cisa.gov/secure-our-world/recognize-and-report-phishing
    accessed: "2026-11-03"
  - "n": 7
    title: "Phishing scams: how to spot and report them"
    publisher: NCSC (UK)
    url: https://www.ncsc.gov.uk/collection/phishing-scams
    published: "2021-11-26"
    accessed: "2026-11-03"
---

# Checking if your email was in a data breach

When a company or a website gets hacked, its customers' credentials can end up in the wrong hands. Knowing whether your address appears in a breach database can reassure or alert you, but it does not replace good password habits.

This page covers what the leading public bodies recommend after a breach: change the password without delay, do not reuse it, turn on two-factor authentication and be wary of fake alert messages.

## In 30 seconds

- Where it happens: a service where you have an account is hacked, and the announcement or a rumour reaches you [1].
- What the attacker wants: to take advantage of reused passwords: one compromised password makes every service where it is used open to attack [1].
- The reflex: change the affected password without delay, never reuse it elsewhere and turn on two-factor authentication [1].
- If it's already done: if the same password is used for your email, change the email password as soon as possible [4].

## Straight answers

### What is a data breach?

An attacker can obtain encrypted (hashed) passwords by breaking into a database, which NIST calls a "database breach" [2]. CISA tells the story of a user whose password was part of a company breach published online [3]. The password is then no longer secret, even if your own computer was never affected.

### Do I have to wait for a breach to be confirmed before acting?

No. When you have doubts about the security of an account, or learn that a company where you have an account has been hacked, Cybermalveillance.gouv.fr recommends not waiting to find out whether it is true. The password concerned must be changed immediately, before it falls into the wrong hands [1].

### What should I do if my address appears in a breach?

Change the password of the service concerned. If you used it for your email, change the email password as soon as possible [4]. Then choose a different password for each service, so that if one is lost or stolen, only that service is vulnerable [1]. Finally, turn on two-factor authentication when the service offers it [5].

### Why does email come first?

It receives the password reset links for your other accounts. A cybercriminal who hacks it can use the "forgot password" function of the services you access, including your bank account, to take control of them [1]. The NCSC adds that they could also read your private information and send messages pretending to be you [4].

### What if my address does not appear in the database I checked?

The advice does not depend on the result of a check: change the password at the first doubt, do not reuse it, turn on two-factor authentication [1][5]. An empty result therefore exempts you from none of these measures.

## How it works

Stolen passwords are first used to guess other passwords. NIST observes that users' choices are very predictable and that attackers try passwords that have already worked, notably those from earlier breaches [2]. The same document recommends that a service compare chosen passwords against a list of values known to be commonly used, expected or compromised, for example passwords from past breaches [2]. This text dates from June 2017 and has been replaced by a more recent revision since 1 August 2025 [2].

The risk grows when one password is used in several places. If you have reused it, criminals only need to know one to get into all your accounts [4]. This is the scenario CISA describes: a user sees a 700-dollar transfer she did not request, then cannot log in to her bank, then to her email, because she had the same password on both. She later learns that this password was part of a company breach published online [3].

## What you do

After a breach, or at the slightest doubt, the following order limits the damage, from the most urgent to the most lasting.

- First change the password of the affected service [1]. If you had reused it for email, change the email password too [4].
- Use a long, random password. CISA indicates at least 16 characters, either a random string or a phrase of 4 to 7 unrelated words [3]. Cybermalveillance.gouv.fr cites a minimum of 12 characters mixing upper-case letters, lower-case letters, digits and special characters [1].
- One password per account. The CNIL asks for a separate, unique password for each sensitive account: bank, email, social network [5].
- Entrust them to a password manager. CISA notes that, for most people, remembering long, random, unique passwords for every account is impossible, and that these tools generate them, store them and flag weak or reused passwords [3].
- Turn on two-factor authentication, especially for email, social networks and financial accounts [3]. The NCSC states that it stops a criminal from getting into your email even if they know the password [4].

For a work account, apply the same measures and follow your organisation's instructions. The NCSC asks that the email password be used on no other account, at home or at work [4].

## Pitfalls

### The fake breach alert

A message that announces a breach and urges you to log in may be phishing. CISA describes as common signs urgent or emotional language, a request for personal or financial information, untrustworthy shortened links and incorrect addresses or links, such as "amazan.com" [6]. Spelling mistakes are no longer a reliable clue: in the age of artificial intelligence, some emails are perfect on that point [6].

Faced with a doubtful message that could be genuine, click no link and call no number it contains. Look up the organisation's website yourself, or type its address, and take its contact details from the verified site [6]. In CISA's example, an email announced a declined payment and urged the reader to log in. The victim handed over their password and card data, and recovered most of their losses only after long hours on the phone [6].

Cybermalveillance.gouv.fr adds that no serious company or organisation will ever ask for your password by email or by phone, even for "maintenance" or "IT support". If you are asked for it, you are facing a hacking or scam attempt [1]. A fake breach message that demands your password falls into this case.

To report the message, CISA indicates that an option is usually found near the sender's address, or in the "report spam" button. It then advises deleting the message without replying or clicking, including on an unsubscribe link [6]. The UK's NCSC states that it can investigate fraudulent addresses and websites and have them removed, and that reporting takes a minute [7].

### The false sense of security

Not appearing in a breach database you checked does not exempt you from good practice. The rule applies in every case: a different password for each account, long passwords and two-factor authentication [1][3][5].

### The password written in the wrong place

After a change, it is tempting to keep the new password in a file or a message. The CNIL advises against sticky notes, text files, the smartphone and the email inbox, and against ever saving them in the browser of a shared computer [5].

## Sources

1. Cybermalveillance.gouv.fr, "Pourquoi et comment bien gérer ses mots de passe ?", 23 November 2019. https://www.cybermalveillance.gouv.fr/tous-nos-contenus/bonnes-pratiques/mots-de-passe (accessed 3 November 2026)
2. NIST, "NIST Special Publication 800-63B". https://pages.nist.gov/800-63-3/sp800-63b.html (accessed 3 November 2026)
3. CISA, "Use Strong Passwords". https://www.cisa.gov/secure-our-world/use-strong-passwords (accessed 3 November 2026)
4. NCSC (UK), "Use a strong and separate password for your email", 17 December 2018. https://www.ncsc.gov.uk/collection/top-tips-for-staying-secure-online/use-a-strong-and-separate-password-for-email (accessed 3 November 2026)
5. CNIL, "Les conseils de la CNIL pour un bon mot de passe", 26 January 2017. https://www.cnil.fr/fr/les-conseils-de-la-cnil-pour-un-bon-mot-de-passe (accessed 3 November 2026)
6. CISA, "Recognize and Report Phishing". https://www.cisa.gov/secure-our-world/recognize-and-report-phishing (accessed 3 November 2026)
7. NCSC (UK), "Phishing scams: how to spot and report them", 26 November 2021. https://www.ncsc.gov.uk/collection/phishing-scams (accessed 3 November 2026)

---

Original source: Cyberpedia, the public cybersecurity and AI encyclopedia published by Brain. Canonical version: https://startbrain.io/cyberpedia/en/articles/have-i-been-pwned-check-email-breach/
You may reuse this text freely under the CC BY 4.0 license (https://creativecommons.org/licenses/by/4.0/), provided you credit "Brain, Cyberpedia" with a link to the canonical URL above.