Your Email Was Found in a Data Breach: What to Do Next

You get the alert. Maybe it's from your password manager. Maybe it's an email from a company you barely remember. Maybe a friend sent you a link.

"Your email was found in a data breach."

Your stomach drops. What did they get? Is your bank account at risk? Do you need to change every password you own?

Take a breath.

A breached email address is common, and it doesn't automatically mean someone has access to your accounts. But it does mean some information connected to you may have been exposed.

What matters now is understanding what leaked and taking the right steps to protect yourself.

Here's exactly what to do.

What Does It Actually Mean When Your Email Is in a Data Breach?

A data breach happens when a company or service exposes information it holds about its users, often because of a cyberattack or security failure.

If your email address appears in a breach, it means a company you had an account with exposed data associated with that address.

It does not automatically mean:

Someone has accessed your email account
Your bank account has been hacked
Your identity has been stolen

But the breach may have exposed more than your email address.

Depending on the incident, leaked information can include:

Email addresses – Often used to identify accounts and target phishing attacks
Passwords – Sometimes exposed in plain text or as password hashes
Names and contact details – Such as phone numbers and physical addresses
Dates of birth – Information that can help scammers impersonate you
Security questions and answers – Potentially useful for account recovery attacks
Payment details – Less common, but particularly concerning when exposed

The important question isn't simply whether your email appeared in a breach.

It's what information was exposed alongside it.

Step 1: Find Out Which Breach Exposed Your Information

Before changing every password you own, find out what happened.

Start with these checks:

Check Have I Been Pwned: Visit haveibeenpwned.com and enter your email address. It can show known breaches associated with it and the types of information exposed.
Read the company's breach notice: If the affected company contacted you, look for details about what was exposed and when the incident happened.
Check your password manager: Tools such as 1Password, Bitwarden, and Google Password Manager can flag compromised or reused passwords.

Write down three things:

The name of the affected service
The information that was exposed
Whether you still use that account

One important warning: Fake breach notifications are also used for phishing. Don't click unexpected links in an email claiming your data was exposed. Visit the company's website directly or use a trusted security service.

Step 2: Change the Breached Password Everywhere You Reused It

If the breach exposed your password, changing it is one of your most urgent tasks.

Start with the affected service.

But don't stop there.

Why password reuse makes breaches more dangerous

Imagine you used the same password for an old shopping website, your email account, and an online payment service.

If the shopping website gets breached, attackers may try that leaked email-and-password combination on other popular services.

This technique is called credential stuffing.

It allows attackers to automate login attempts across multiple websites using credentials exposed in previous breaches.

If you've reused the password, prioritize changing it on:

Your primary email account
Banking and payment services
Shopping accounts with saved payment details
Social media accounts
Other important services

The rule is simple: If you reused the exposed password anywhere, change it there too.

Step 3: Secure Your Email Account First

Your email account is one of the most important accounts you own.

Why?

Because it's often used to reset passwords, receive security notifications, and recover access to other services.

If someone gains control of your inbox, they may be able to take over several of your other accounts.

Here's how to secure it:

Change your email password: Use a long, unique password that you haven't used anywhere else.
Enable two-factor authentication (2FA): Use an authenticator app or passkey where supported.
Review recent sign-in activity: Check for unfamiliar devices, locations, or login attempts.
Sign out unknown devices: Remove sessions you don't recognize.
Check forwarding rules and filters: Look for rules you didn't create that could secretly forward or hide your messages.
Verify recovery details: Make sure the recovery email address and phone number still belong to you.

For Gmail, you can review account activity and security settings through your Google Account. For Outlook, check the security and sign-in activity sections of your Microsoft account.

Step 4: Enable Two-Factor Authentication on Important Accounts

A compromised password is less useful to an attacker when your account has another layer of protection.

Two-factor authentication requires an additional verification step when someone tries to sign in.

Prioritize enabling it on:

Email accounts
Banking and payment services
Cloud storage such as Google Drive, iCloud, and Dropbox
Social media accounts
Your password manager

Which 2FA method should you use?

Where available, prioritize:

Passkeys or security keys: Strong protection against many phishing attacks.
Authenticator apps: Generate verification codes without relying on text messages.
SMS codes: Better than having no additional protection, but more vulnerable to attacks such as SIM swapping.

You don't have to secure every account in one sitting. Start with the accounts that could cause the most damage if someone accessed them.

Step 5: Watch Out for Phishing Attempts

After a breach, your email address may circulate among people who use leaked information to target victims.

You might receive more convincing phishing messages than usual.

Some may mention the exact company involved in the breach. Others may use your real name, phone number, or even an old password to make the message look legitimate.

Watch for warning signs such as:

Emails asking you to verify your account after the breach
Messages threatening to close your account unless you act immediately
Links to websites with slightly altered addresses
Unexpected attachments or requests for personal information
Messages asking you to provide passwords or verification codes

Never log in through a link in an unexpected security email.

Open the official website or app yourself and check your account there.

Step 6: Protect Your Money and Identity if Sensitive Information Leaked

Not every breach requires you to contact your bank or replace your identity documents.

Your response should depend on the information that was exposed.

If payment card details were exposed

Contact your bank or card issuer.
Ask whether your card should be replaced.
Review recent transactions.
Report anything you don't recognize.

If identity or financial information was exposed

Be more cautious if the breach included government identification numbers, dates of birth, addresses, or financial information.

Monitor your bank and financial accounts.
Contact relevant institutions if you suspect misuse.
Ask your bank what fraud-protection options are available in your country.

In the United States, people can also consider placing a free credit freeze with Equifax, Experian, and TransUnion.

If only your email address was exposed, you generally don't need to take all these additional steps. Focus on securing your accounts and watching for phishing.

Step 7: Delete Old Accounts You No Longer Use

Here's something many breach-response guides overlook.

Some of the accounts exposing your information may be accounts you created years ago and completely forgot about.

An old discussion forum. A shopping website. A mobile app you tried once. A newsletter you subscribed to and never opened again.

You may not use these services anymore, but they could still hold information about you.

After dealing with the immediate breach:

Delete the affected account if you no longer need it.
Search for other forgotten accounts connected to your email address.
Close accounts you no longer use.
Keep the accounts you still need and secure them properly.

Every unnecessary account you close is one less place holding your personal information.

You can't prevent every company from experiencing a breach. But you can reduce how many companies have your information in the first place.

Your Data Breach Response Checklist

If you want a simple action plan, use this one.

Do now: The first hour

Confirm which service was breached.
Find out what information was exposed.
Change the affected password.
Change it everywhere you reused it.
Secure your primary email account.
Enable 2FA on your most important accounts.

Do this week

Enable 2FA on banking, cloud storage, and social media accounts.
Set up a password manager if you don't already use one.
Contact your bank if payment information was exposed.
Review account activity and recovery settings.

Do this month

Find and delete accounts you no longer use.
Review other accounts connected to your email address.
Continue watching for suspicious messages and login attempts.
Make unique passwords and 2FA part of your regular security habits.

The Faster Way: Let GhostSweep Find Your Exposed Accounts

Responding to one breach is manageable.

The harder part is knowing how many other accounts are still connected to your email address, and whether any of them have appeared in known data breaches.

That's where GhostSweep comes in.

GhostSweep helps you:

Find accounts: Scan your Gmail or Outlook inbox for services you've signed up for.
Check for breaches: Identify accounts associated with known data breaches.
Prioritize what matters: See which accounts may need your attention.
Clean up forgotten accounts: Get direct links and guidance for deleting accounts you no longer need.

Instead of manually searching through years of emails, you can get a clearer picture of your online accounts in one place.

Your emails are processed in memory—never stored or sold. GhostSweep is verified under Google's CASA security assessment for apps that access Gmail.

You can try it at ghostsweep.com.

Key Takeaways

Finding your email in a breach doesn't automatically mean someone has accessed your accounts.
Check which breach occurred and what information was exposed.
Change compromised passwords immediately, especially anywhere you reused them.
Secure your primary email account first because it can be used to recover access to other accounts.
Enable 2FA on important services.
Expect phishing attempts and avoid logging in through unexpected email links.
Delete forgotten accounts to reduce the amount of personal information held by services you no longer use.

You can't control whether a company gets hacked. But you can control how well your accounts are protected and how much unnecessary information you leave behind.

Want to know which of your accounts are exposed? GhostSweep scans your inbox, finds accounts tied to your email, and flags those associated with known breaches. Free to try, with a scan that takes about 2 minutes.

Your Email Was in a Data Breach. Here's Exactly What to Do Next