Checking if your email was in a data breach
A data breach puts your password in circulation. How to react at once, and why an address missing from a database proves nothing.
In 30 seconds
- Where it happens
- A service where you have an account is hacked, and the announcement or a rumour reaches you1.
- What the attacker wants
- To take advantage of reused passwords: one compromised password makes every service where it is used open to attack1.
- The reflex
- Change the affected password without delay, never reuse it elsewhere and turn on two-factor authentication1.
- If it's already done
- If the same password is used for your email, change the email password as soon as possible4.
What it is
When a company or a website gets hacked, its customers' credentials can end up in the wrong hands. Knowing whether your address appears in a breach database can reassure or alert you, but it does not replace good password habits.
This page covers what the leading public bodies recommend after a breach: change the password without delay, do not reuse it, turn on two-factor authentication and be wary of fake alert messages.
Straight answers
What is a data breach?
An attacker can obtain encrypted (hashed) passwords by breaking into a database, which NIST calls a "database breach"2. CISA tells the story of a user whose password was part of a company breach published online3. The password is then no longer secret, even if your own computer was never affected.
Do I have to wait for a breach to be confirmed before acting?
No. When you have doubts about the security of an account, or learn that a company where you have an account has been hacked, Cybermalveillance.gouv.fr recommends not waiting to find out whether it is true. The password concerned must be changed immediately, before it falls into the wrong hands1.
What should I do if my address appears in a breach?
Change the password of the service concerned. If you used it for your email, change the email password as soon as possible4. Then choose a different password for each service, so that if one is lost or stolen, only that service is vulnerable1. Finally, turn on two-factor authentication when the service offers it5.
Why does email come first?
It receives the password reset links for your other accounts. A cybercriminal who hacks it can use the "forgot password" function of the services you access, including your bank account, to take control of them1. The NCSC adds that they could also read your private information and send messages pretending to be you4.
1How it works1 min
Stolen passwords are first used to guess other passwords. NIST observes that users' choices are very predictable and that attackers try passwords that have already worked, notably those from earlier breaches2. The same document recommends that a service compare chosen passwords against a list of values known to be commonly used, expected or compromised, for example passwords from past breaches2. This text dates from June 2017 and has been replaced by a more recent revision since 1 August 20252.
The risk grows when one password is used in several places. If you have reused it, criminals only need to know one to get into all your accounts4. This is the scenario CISA describes: a user sees a 700-dollar transfer she did not request, then cannot log in to her bank, then to her email, because she had the same password on both. She later learns that this password was part of a company breach published online3.
2What you do1 min
After a breach, or at the slightest doubt, the following order limits the damage, from the most urgent to the most lasting.
- First change the password of the affected service1. If you had reused it for email, change the email password too4.
- Use a long, random password. CISA indicates at least 16 characters, either a random string or a phrase of 4 to 7 unrelated words3. Cybermalveillance.gouv.fr cites a minimum of 12 characters mixing upper-case letters, lower-case letters, digits and special characters1.
- One password per account. The CNIL asks for a separate, unique password for each sensitive account: bank, email, social network5.
- Entrust them to a password manager. CISA notes that, for most people, remembering long, random, unique passwords for every account is impossible, and that these tools generate them, store them and flag weak or reused passwords3.
- Turn on two-factor authentication, especially for email, social networks and financial accounts3. The NCSC states that it stops a criminal from getting into your email even if they know the password4.
For a work account, apply the same measures and follow your organisation's instructions. The NCSC asks that the email password be used on no other account, at home or at work4.
3Pitfalls2 min
The fake breach alert
A message that announces a breach and urges you to log in may be phishing. CISA describes as common signs urgent or emotional language, a request for personal or financial information, untrustworthy shortened links and incorrect addresses or links, such as "amazan.com"6. Spelling mistakes are no longer a reliable clue: in the age of artificial intelligence, some emails are perfect on that point6.
Faced with a doubtful message that could be genuine, click no link and call no number it contains. Look up the organisation's website yourself, or type its address, and take its contact details from the verified site6. In CISA's example, an email announced a declined payment and urged the reader to log in. The victim handed over their password and card data, and recovered most of their losses only after long hours on the phone6.
Cybermalveillance.gouv.fr adds that no serious company or organisation will ever ask for your password by email or by phone, even for "maintenance" or "IT support". If you are asked for it, you are facing a hacking or scam attempt1. A fake breach message that demands your password falls into this case.
To report the message, CISA indicates that an option is usually found near the sender's address, or in the "report spam" button. It then advises deleting the message without replying or clicking, including on an unsubscribe link6. The UK's NCSC states that it can investigate fraudulent addresses and websites and have them removed, and that reporting takes a minute7.
The false sense of security
Not appearing in a breach database you checked does not exempt you from good practice. The rule applies in every case: a different password for each account, long passwords and two-factor authentication135.
The password written in the wrong place
After a change, it is tempting to keep the new password in a file or a message. The CNIL advises against sticky notes, text files, the smartphone and the email inbox, and against ever saving them in the browser of a shared computer5.
Fact sheet
- Identifier
- CP-349
- Wing
- 5. Office life and reflexes
- Brain skill
- Mastering Passwords & MFA (master_passwords)
- Brain reflex
- cr-022
- Diagram
- G2 · Visual vs Technical Indicators
- Languages
- de, en, fr
- Sources
- 7 sources checked on 3 November 2026
Sources7 sources
- Cybermalveillance.gouv.fr, “Pourquoi et comment bien gérer ses mots de passe ?”, 23 November 2019. https://www.cybermalveillance.gouv.fr/tous-nos-contenus/bonnes-pratiques/mots-de-passe (accessed 3 November 2026)
- NIST, “NIST Special Publication 800-63B”. https://pages.nist.gov/800-63-3/sp800-63b.html (accessed 3 November 2026)
- CISA, “Use Strong Passwords”. https://www.cisa.gov/secure-our-world/use-strong-passwords (accessed 3 November 2026)
- NCSC (UK), “Use a strong and separate password for your email”, 17 December 2018. https://www.ncsc.gov.uk/collection/top-tips-for-staying-secure-online/use-a-strong-and-separate-password-for-email (accessed 3 November 2026)
- CNIL, “Les conseils de la CNIL pour un bon mot de passe”, 26 January 2017. https://www.cnil.fr/fr/les-conseils-de-la-cnil-pour-un-bon-mot-de-passe (accessed 3 November 2026)
- CISA, “Recognize and Report Phishing”. https://www.cisa.gov/secure-our-world/recognize-and-report-phishing (accessed 3 November 2026)
- NCSC (UK), “Phishing scams: how to spot and report them”, 26 November 2021. https://www.ncsc.gov.uk/collection/phishing-scams (accessed 3 November 2026)
Cite this article
Brain, “Checking if your email was in a data breach”, Cyberpedia, 2026. https:/
BibTeX
@misc{brain_cp349_en_2026,
author = {Brain},
title = {Checking if your email was in a data breach},
year = {2026},
howpublished = {Cyberpedia},
url = {https://startbrain.io/cyberpedia/en/articles/have-i-been-pwned-check-email-breach/},
note = {CC BY 4.0}
}