Super OK! Recommended
Available guides
- Guide: IT support contract for businesses or on-demand callouts? How to choose the right option
- Guide: Custom business app: When is it worth it and what features do you need?
- Guide: Is your laptop overheating? 10 causes and solutions
- Guide: Laptop won't turn on? 12 common causes and diagnostic solutions
- Guide: How to publish an app on Google Play: steps and requirements
Guide: Tutorial on how to check if your email has been compromised in a data breach
If you have been using the same email address for several years, it is possible that it has appeared in an online service data breach. A data breach can expose information such as your email address, username, phone number or, in some cases, passwords and other data.
In this tutorial you will learn step by step how to check if your email address appears in a data breach and what measures you can take if you find an exposure.
Important:
never enter your account password on a site that claims to check for data breaches. For verification, the email address is usually sufficient.
1. What is a data breach?
A data breach occurs when information stored by an organisation is accessed, copied, stolen or disclosed without authorization.
Depending on the incident, different categories of information may be exposed.
| Type of information | Example |
|---|---|
| Email address | nume@example.com |
| Username | username used on a service |
| Phone number | number associated with the account |
| Password | may appear in some breaches, depending on the incident and how the service stored the data |
| Other data | information depends on the affected service and the nature of the breach |
2. What you need before checking
You only need the email address you want to check.
1
Email address
Prepare the address you want to check.
2
A browser
You can use Chrome, Edge, Firefox, Safari or another modern browser.
3
Account access
If you find an exposure, it is helpful to be able to access the respective account to change its password.
4
A password manager
It can be useful if you have multiple different passwords and want to manage them securely.
3. Check the email address
For verification you can use a reputable service specialised in identifying email addresses associated with known breaches.
A well-known example is the service Have I Been Pwned. Go to the official page and enter the email address you want to check.
What you need to enter:
nume@example.com
Enter only the email address. Do not enter the password.
4. Analyse the result
If the service indicates that the address was not found in known breaches in its database, this means that it has not identified an association for the checked address in the data it holds.
If a breach is identified, check the information displayed for the incident.
| Result | What it means |
|---|---|
| No results | The address was not identified in known breaches by the service used for verification. |
| There is a breach | The address appears associated with a known security incident. |
| Multiple breaches | The address has been associated with multiple known incidents. |
Important:
the fact that an address does not appear in a breach database does not prove that it has never been exposed. Verification services do not necessarily have access to all existing incidents.
5. Check what information has been exposed
If a breach occurs, do not just look at the company name. Also check the types of data associated with the incident.
For example, it is different if the incident exposed only an email address compared to an incident where other data was also exposed.
Check in particular:
- email;
- username;
- phone number;
- password or authentication-related information;
- other account-associated data.
6. If the password has been exposed, change it immediately
If the incident indicates that the account password has been exposed, change the password directly on the respective service's official website.
- Manually open the service's official website.
- Log in to the account.
- Go to the security or password section.
- Change the password.
- Use a new and unique password.
Do not reuse the compromised password.
If the same password was also used on other websites, change it there too.
7. Check if you have reused the same password
One of the major issues arises when the same password is used for multiple accounts.
For example, if you have used the same email and password combination on three different services, compromising one of them can increase the risk for the other accounts.
Simple rule:
every important account should have a unique password.
8. Enable two-factor authentication
After changing your password, check if the service offers two-factor authentication, also known as 2FA.
With 2FA enabled, authentication may require a second factor in addition to the password.
- Open account settings.
- Look for the section Security.
- Look for the option Two-factor authentication or 2FA.
- Follow the steps indicated by the service.
- Keep recovery codes in a safe place, if the service provides them.
9. Check account activity
If you suspect an account has been accessed by someone else, check if the service offers a section for recent activity, connected devices, or active sessions.
Look for devices, locations, or sessions that you do not recognise.
If you find an unknown session:
- close that session if the service allows it;
- change the password;
- enable 2FA;
- check account recovery methods.
10. Check recovery methods
Check whether the secondary email address or phone number associated with the account is correct.
If you notice recovery details that you did not configure yourself, treat the situation as a potential security incident and secure the account immediately.
11. What should you do if you have the same password on multiple accounts?
It is not necessary to change all passwords at random. Start with important accounts and those that use the same password.
| Practical priority | Accounts | Action |
|---|---|---|
| 1 | Primary email | Change your password and enable 2FA. |
| 2 | Financial accounts | Use unique passwords and check account security. |
| 3 | Work accounts | Change your password if it has been reused. |
| 4 | Important accounts | Replace reused passwords with unique passwords. |
12. Use different passwords for different accounts
If you have many accounts, memorising all of them individually can become difficult. A password manager can generate and store unique passwords for each service.
A safer structure:
- a unique password for each service;
- 2FA enabled for important accounts;
- recovery codes kept securely;
- primary email properly protected.
13. What do you do after checking your email?
If there are no results, you can continue checking important accounts and make sure you use unique passwords and two-step verification where available.
If there are results, analyse each incident and check whether the password or other data associated with the account has been reused.
1
Identify the incident
See which service was affected and what types of data are associated.
2
Change passwords
Replace compromised or reused passwords.
3
Enable 2FA
Use two-step verification where available.
4
Check activity
Monitor the devices and active sessions of important accounts.
14. What NOT to do
- Do not enter your password on a site that claims to check for breaches.
- Do not use the same password for multiple important accounts.
- Do not access suspicious links received by email to "secure" your account.
- Do not ignore a genuine security notification from a service you use.
- Do not assume that the absence of a result means data has never been exposed.
15. Final checklist
Do you need help?
If you need help securing, configuring or using software applications and services, you can rely on the assistance Software consultancy offered by iTechServiceTM.
RECOMMEND & EARN
You can earn 10% from each referral!
Recommend iTechServiceTM to someone who needs IT & Web services and you receive 10% of the service value, if the referral is eligible and the service is paid in full.
Find out how it works →Available guides
- Guide: IT support contract for businesses or on-demand callouts? How to choose the right option
- Guide: Custom business app: When is it worth it and what features do you need?
- Guide: Is your laptop overheating? 10 causes and solutions
- Guide: Laptop won't turn on? 12 common causes and diagnostic solutions
- Guide: How to publish an app on Google Play: steps and requirements
Google Reviews
Experiences shared by our clients
5,0 / 5 out of 20 Google reviews.