Your Email Showed Up in a Data Breach: What to Do Next

If your email address shows up in a data breach, start by finding out what else leaked with it. If a password leaked, change it on that site and on every other account where you reused it, then turn on two-factor authentication. If your Social Security number or financial details leaked, freeze your credit at all three bureaus. If someone has already used your information, report it at IdentityTheft.gov.

Most people whose email appears in a breach need only the first two steps. Here's how to tell which group you're in and what to do.

Step 1: Find out what was exposed

An email address on its own is low-risk. It mainly means more spam and phishing. The breach matters more when the email is paired with something else.

The easiest check is Have I Been Pwned, a free service that collects breach data so people can see where their information was exposed. Enter your email, and it lists the breaches that included it and what kinds of data each one contained. According to its FAQ, searches aren't logged, and the most sensitive breaches are shown only to the verified owner of the address.

If you got a notice from the company itself, read it closely. It should say what was taken and what the company is offering, such as free credit monitoring.

Step 2: Change the passwords that matter

Change the password on the breached site first. Then think about every other site where you used the same or a similar password. Attackers take leaked email-and-password pairs and try them everywhere, so reused passwords are the real danger.

1. Start with your email account. Whoever controls your email can reset almost every other password you have.
2. Then banking, payment apps, and shopping sites with saved cards.
3. Then social media and anything else that used the same password.
4. Use a unique password for each. Long and random beats clever. A password manager makes this realistic.

Have I Been Pwned also runs Pwned Passwords, which checks whether a password has appeared in any known breach. Its FAQ says a password found there "should no longer be used." The check is designed so the full password isn't sent to the service.

Step 3: Turn on two-factor authentication

Two-factor authentication (2FA, also called multifactor authentication) adds a second step at login. Even if someone has your password, they can't get in without the second factor. CISA, the federal cybersecurity agency, recommends turning it on for email, banking, and other important accounts.

The options, roughly from good to best:

• Text or email codes. Better than nothing, and widely available.
• Authenticator apps that generate a fresh code every 30 seconds.
• Phishing-resistant methods such as passkeys or physical security keys (FIDO). CISA points to these as the strongest option.

To set it up, look in each account's security settings for "two-factor," "two-step verification," or "multifactor." Save the backup codes somewhere safe, like your password manager.

Step 4: Freeze your credit if sensitive data leaked

If your Social Security number, date of birth, or financial details were in the breach, freeze your credit. The FTC says a freeze is free, doesn't affect your credit score, and stays in place until you lift it. While it's active, lenders generally can't pull your report, so new accounts can't be opened in your name.

You have to contact each bureau separately:

• Equifax: online through its credit freeze page, or by phone at (888) 298-0045.
• Experian: online through a free Experian account, by phone at 1-888-397-3742, or by mail. Experian says online freezes take effect in real time.
• TransUnion: online through the TransUnion Service Center. TransUnion says freezes often take effect right away but to allow up to an hour.

When you need to apply for credit, a job, or an apartment, lift the freeze temporarily. The FTC suggests lifting it only at the bureau the lender will use.

Fraud alerts: the lighter option

A fraud alert tells lenders to verify your identity before opening credit. It's free, lasts one year, and you only contact one bureau, which must tell the other two. If you've actually been a victim, an extended fraud alert lasts seven years and requires an FTC identity theft report or police report.

Check your credit reports

You can check your reports from all three bureaus for free every week at AnnualCreditReport.com, which the FTC calls the only authorized site for free reports. Look for accounts or inquiries you don't recognize.

Step 5: Watch for phishing

A breached email address mostly means better-targeted scam emails. The attacker may know where you shop and what you bought. The FTC's four warning signs of a scam apply here:

• Someone pretends to be a company or agency you trust.
• There's a problem or a prize.
• They push you to act right away.
• They want payment by gift card, crypto, wire transfer, or a payment app.

Expect emails that say "your account was in a breach, click here to secure it." Don't click. Go to the company's site directly by typing the address or using your bookmark.

If you use a VPN with scam-site blocking, keep it on. NordVPN includes DNS-based phishing and scam site blocking in every plan, and Surfshark's CleanWeb blocks known malicious sites. They help, but they won't catch every new fake page. Our VPN vs antivirus guide explains where each fits.

Step 6: If your identity was actually stolen

Signs the FTC lists include bills you don't recognize, bank withdrawals you didn't make, accounts on your credit report that aren't yours, and regular bills that suddenly stop arriving.

If you see any of these, report it at IdentityTheft.gov (or RobodeIdentidad.gov in Spanish). You'll get a free personal recovery plan and an FTC identity theft report. For other languages, the FTC lists 877-438-4338. Report scams that didn't involve identity theft at ReportFraud.ftc.gov.

Set up breach monitoring so you hear first

You won't always get a letter from the company that lost your data. Monitoring services watch breach data and tell you when your details appear:

• Have I Been Pwned's notification service is free. Sign up with your address and it emails you if it shows up in a future breach it loads.
• NordVPN Dark Web Monitor comes with every NordVPN plan and covers up to 5 email addresses. Complete and Prime upgrade to Dark Web Monitor Pro, which adds phone, card, and national ID or SSN monitoring.
• Surfshark Alert comes with Surfshark One and One+ and watches emails, card details, and IDs.

If you'd rather fold monitoring into a VPN you'd use anyway, both are on Black Friday pricing right now. Our NordVPN vs Surfshark comparison covers the differences.

Special cases

The company offers free credit monitoring

Breach notices often include a code for free credit monitoring. Read what the offer covers and how long it lasts before you sign up, and note any date by which you have to enroll. Monitoring tells you about new activity on your credit file; it doesn't stop it. A freeze still does more to prevent new-account fraud.

Your child's information was exposed

Children's Social Security numbers are attractive to thieves because no one checks a kid's credit for years. The FTC says parents can request a free credit freeze for a child under 16, using each bureau's process for minors. Equifax, for example, uses a Minor Freeze Request form with proof of identity and authority.

An older parent's data was exposed

Help them through the same steps, and consider freezing their credit even if they rarely apply for new accounts. If you're helping set up their devices over the holidays, our guide to family online safety covers the basics.

Your 15-minute checklist

1. Check Have I Been Pwned and note what leaked.
2. Change your email password and turn on 2FA for it.
3. Change any reused passwords, starting with banking.
4. Freeze your credit at all three bureaus if an SSN or financial data leaked.
5. Sign up for breach alerts so you hear about the next one.
6. Bookmark IdentityTheft.gov in case you ever need it.