Quick answer: Enter your email address at Have I Been Pwned, a free breach-checking site, to see whether it appeared in a known leak. If it did, change the password for that account (and anywhere you reused it), turn on two-step verification, and watch for scam messages. If sensitive details like a government ID number were exposed, add a credit freeze or fraud alert where your country offers one.
Breach notices are easy to ignore, and that’s the problem. Leaked details are often reused for phishing, account takeovers and identity fraud months after the original incident.
This guide gives you a calm, ordered checklist you can finish in about 30 minutes, with country-specific help lines for the US, UK, Canada and Australia. More everyday security explainers are in our Tech News section.
How do you check if you were in a data breach?
Have I Been Pwned is a free service created by security researcher Troy Hunt. You type in an email address and it tells you which known breaches included it. It also offers a “Notify Me” feature, which emails you if your address shows up in a future breach, and a Pwned Passwords tool for checking whether a password has leaked.
Check every email address you use, including old ones. Then check the company’s own notice if you received one. A real notice will name the company, say what was taken, and avoid pressuring you to click.
Watch out for fake breach emails
Scammers copy breach notices. Don’t click links in an unexpected “your account was breached” email. Open the company’s app or type its address yourself.
What should you do first if you were affected?
- Change the password for the breached account right away. Then change it anywhere else you used the same one.
- Turn on two-step verification (also called two-factor authentication) for your email first, since email can reset almost everything else. The UK’s NCSC lists a strong email password and two-step verification among its top tips for staying secure online.
- Use a password manager so each account gets a unique password. The NCSC also recommends this, plus the “three random words” method for passwords you must remember.
- Review recent activity on the account, such as logins, forwarding rules in email and saved payment cards.
- Keep records of any emails or chats with the company.
What if your financial or ID details were exposed?
This is the more serious case, and the steps depend on where you live.
United States
The FTC says credit freezes and fraud alerts are both free. A freeze means nobody can open new credit in your name, including you, until you lift it. You contact each of the three bureaus (Equifax, Experian and TransUnion) separately. A fraud alert needs just one bureau, which tells the other two, and lasts one year for an initial alert. If someone has already misused your identity, report it and get a recovery plan at IdentityTheft.gov.
United Kingdom
The ICO advises asking the organization what happened, what data was involved and how it’s protecting you. It also suggests monitoring bank and card statements and applying for protective registration with Cifas, the UK’s fraud prevention service. If the organization doesn’t respond properly within a month, you can complain to the ICO.
Canada and Australia
In Canada, report fraud and identity theft through the Canadian Anti-Fraud Centre, which is run by the RCMP. In Australia, IDCARE describes itself as the national identity and cyber incident support service and offers free help after scams and data breaches. Its individual helpline is 1800 595 160.
European Union
We haven’t covered every EU country’s process here. Under GDPR you can ask a company what data it holds and how it was affected, and you can complain to your national data protection authority. Check your own country’s regulator for the exact route.
What do the signs of misuse look like?
After a breach, the first thing most people see is an uptick in scam messages that sound unusually well informed. They may mention your real name, an order you placed or a service you use. Treat these with extra suspicion, even when the sender seems to know you.
Other warning signs include password-reset emails you didn’t request, login alerts from places you’ve never been, small unexplained card charges, and bills or letters for accounts you didn’t open. If you spot any of these, change passwords first, then contact your bank or card issuer using the number on your card, not one from a message.
If a bank account or card number was exposed, ask the issuer to replace the card. That costs you nothing in most cases and shuts the door quickly.
How can you reduce the damage from the next breach?
You can’t prevent a company from losing data, but you can limit what a leak is worth to a criminal.
- Use a unique password for every account.
- Give shops and apps only the details they truly need.
- Consider an email alias or a separate address for sign-ups.
- Back up important files so ransomware or account loss isn’t a disaster.
- Install updates promptly, since many attacks use known flaws.
None of this is glamorous, and it works. Most account takeovers come from reused passwords, not clever hacking.
On updates: install security patches promptly, but you needn’t rush optional previews. Occasionally an update causes its own trouble, as with the Windows 11 KB5124010 audio crashes Microsoft confirmed in October 2026, and the safe habit is to wait for regular monthly releases.
If you’re also wondering what AI tools do with the text you type into them, our explainer on AI text watermarks covers one piece of that picture, and it’s worth a read before you paste anything sensitive into a chatbot.
Frequently asked questions
Is Have I Been Pwned safe to use?
The site is a long-running free resource that shows whether an email address appears in known breaches. Type the address in yourself on the real site, and never trust a link from an unexpected message.
Does being in a breach mean I’ve been hacked?
Not necessarily. It means some of your details were exposed. Whether that leads to harm depends on what was taken and whether you reused the password.
Should I freeze my credit after every breach?
Not after every one. A freeze makes most sense when sensitive identifiers were exposed or you’re not applying for credit soon. In the US it’s free and easy to lift when you need it.
How often should I check?
Turn on breach alerts once, and recheck when a company you use reports an incident. That’s less effort than checking monthly and works better.