What to Do After a Data Breach: A Calm, Step by Step Checklist
Eight steps in order, from changing reused passwords to a credit freeze, with a table of what to do for each type of exposed data.
Read the guide
Independent guide · Updated October 7, 2026
How to check if your email appeared in a data breach
Free tools can show you which known data breaches include your email address and what kind of information was involved. This guide shows you where to check, how to read the results, and what to do next, step by step.
See the free ways to check What to do after a breach
We do not run a scanner and there are no forms on this site. We never ask for your email, passwords or Social Security number.
Two free ways to check your email
Both tools search collections of known breach data. Neither needs a payment or your Social Security number.
1
Have I Been Pwned
Go to haveibeenpwned.com and search for your email address. You will see a list of breaches that include it, with the date and the types of data exposed. To get an email when your address shows up in a future breach, sign up for its free Notify Me service.
2
Mozilla Monitor
Go to monitor.mozilla.org and run the free scan with your email. With a free account it monitors up to five email addresses, alerts you to new breaches and walks you through steps to resolve each one.
A note on Google: Google's free dark web report was discontinued in 2026, with scans ending in January and the report removed on February 16, 2026. Google now points people to Security Checkup and Password Checkup instead.
How to read your results
Look at the data types
An exposed email address alone mostly means more spam and phishing. An exposed password means you should change it everywhere you used it. An exposed Social Security number or financial details call for a credit freeze and closer monitoring.
Look at the date
A breach from many years ago with an old password you no longer use is low risk. A recent breach involving a password you still use is the one to deal with today.
A result is not identity theft
Most email addresses appear in at least one breach. It means data was exposed, not that anyone has used it. Learn the real warning signs.
No result is not a guarantee
Breach tools only know about breaches that have been found and loaded. Some breaches are never made public, and Have I Been Pwned hides "sensitive" breaches until you verify your address.
If your email shows up: five free steps
- Change the exposed password and every reused copy of it, starting with your email and bank accounts.
- Turn on two-factor authentication for email, banking and social media. See our password and two-factor guide.
- Freeze your credit at Equifax, Experian and TransUnion. It is free and blocks new accounts in your name. See credit freeze vs fraud alert.
- Watch for phishing that uses your real details. Contact companies through their app or website, not through links in messages.
- Check your credit reports for free every week at AnnualCreditReport.com, and use IdentityTheft.gov if you see signs of misuse.
The full version, with a table for each type of exposed data, is our step by step data breach checklist.
Free tools vs paid monitoring
Free breach checkers watch your email address. Paid identity monitoring services watch more: your Social Security number, your credit file at one or three bureaus and other personal details, and they add restoration specialists and insurance. That is useful to some people and unnecessary for others, especially if you already freeze your credit and check your reports. Our honest comparison covers what paying adds and what no service can do.
Guides
Credit Freeze vs Fraud Alert: How to Set Up Both at Equifax, Experian and TransUnion
What a freeze and a fraud alert do, how long each lasts, and how to set them up at Equifax, Experian and TransUnion for free.
Read the guidePassword Managers and Two-Factor Authentication: A Beginner's Setup Guide
Stop one breach from unlocking your other accounts: unique passwords with a password manager and two-factor, set up in the right order.
Read the guideHow to Tell if Someone Is Using Your Identity, and How to Report It
The warning signs that someone is actually using your information, how to check for free and how to report it at IdentityTheft.gov.
Read the guideFree Breach Checks vs Paid Identity Monitoring: What Paying Actually Adds
Have I Been Pwned and Mozilla Monitor vs paid identity monitoring: what paying adds, what it cannot do, and how to decide.
Read the guideFrequently asked questions
Does this site check my email?
No. We do not run a breach scanner and there is no form on this site. To check an address, use a free tool such as Have I Been Pwned or Mozilla Monitor on their own websites. We explain how above.
Is it safe to type my email into a breach checker?
Have I Been Pwned and Mozilla Monitor are long running, well known services. Have I Been Pwned's FAQ says searched addresses are not harvested. As a rule, only type your email address into a site you reached by typing its address yourself, and never enter a password, Social Security number or one-time code into a site that only promises to "check" something.
My email was in a breach. Has my identity been stolen?
Not necessarily. Being in a breach means some information was exposed. Identity theft means someone used it. Our guide to signs of identity theft explains how to tell the difference.
Is a credit freeze really free?
Yes. According to the FTC, placing and lifting a credit freeze is free at all three nationwide credit bureaus, and it does not affect your credit score. See our credit freeze guide.
Do I need to pay for identity monitoring?
No. The most important steps are free. Paid services add monitoring of your Social Security number and credit, restoration help and insurance, which some people find worth the monthly cost. Our free vs paid comparison explains the tradeoff.
What happened to Google's dark web report?
Google discontinued it. Scanning stopped in January 2026 and the report was removed on February 16, 2026. Have I Been Pwned and Mozilla Monitor offer free breach alerts for your email instead.