The Email You Hope You Never Get
"We are writing to inform you of a security incident affecting some of our users."
Most people read that, feel briefly uneasy, and do nothing. Which is understandable — the message is deliberately vague, the company is plainly hoping you will not read past the first paragraph, and it is not obvious what you are supposed to do anyway.
So let us make it concrete: what a breach actually is, how to find out whether you are in one, and the short list of things worth doing about it.
What a Data Breach Actually Involves
A breach is simply a copy of a company's user database ending up somewhere it should not be. The important question is never "was I breached" but what was in the copy, because the answer ranges from mildly annoying to genuinely serious.
Email addresses only
The most common and least alarming. The practical consequence is more spam and more convincing phishing, because whoever has the list knows you use that service.
Email addresses and passwords
This is the one that matters, and how much depends entirely on how the passwords were stored.
- Plain text — the company stored your actual password. Inexcusable in 2026 and still happens. Assume it is known.
- Weakly hashed — scrambled with outdated methods like unsalted MD5 or SHA-1. These are cracked in bulk, quickly. Treat as compromised.
- Properly hashed — bcrypt, scrypt, Argon2 with salting. A strong, unique password is probably still safe. A short or common one is not, because attackers work through likely guesses.
Breach notifications rarely spell this out. If the wording is vague, assume the worse case.
Personal details
Name, date of birth, address, phone number. This does not get an account taken over, but it makes identity fraud and targeted scams much easier, and unlike a password you cannot change your date of birth.
Payment or identity documents
The serious tier. Card numbers, bank details, passport or ID scans. This warrants contacting your bank and considering a credit freeze — not just changing a password.
How to Check
Go to Have I Been Pwned, type your address, read the results. It is free, it is run by a well-known security researcher, it has been the standard tool for over a decade, and it asks for nothing but the address.
Check every address you use, including old ones. People are routinely surprised by an abandoned account from fifteen years ago sitting in a breach with a password they still use somewhere.
One warning. Search for "check if my email was leaked" and you will find dozens of sites offering the same service. Many exist to harvest addresses, upsell a subscription, or scare you into buying protection you do not need. Stick to the well-established one.
Reading the results
You will get a list of breaches with dates and what was exposed. Work down it and sort each into:
- Password exposed, and I reused it — urgent, deal with today.
- Password exposed, but unique to that site — change it, then move on.
- Address only — nothing to fix. This explains some of your spam.
Most people find the list longer than expected. That is normal and not a reflection on you. Breaches are a failure of the companies holding your data, not of the people who trusted them with it.
What To Do, In Order
1. Deal with password reuse first
The real danger is almost never the breached account. It is that the same password unlocks your email, or your bank, or a shopping account with a saved card.
Attackers automate this. They take a leaked list and try every combination against hundreds of popular services. It is called credential stuffing, it is cheap, and it works often enough to be a whole industry.
So: if the leaked password is used anywhere else, change it there first — starting with your email account, because whoever controls your email can reset everything else.
2. Turn on two-factor authentication
If you do only one thing from this article, do this. Two-factor authentication means a stolen password alone is not enough, which defeats credential stuffing outright.
In rough order of strength: a hardware key is best, an authenticator app is very good, SMS codes are weaker but far better than nothing. Turn it on for your email account first, then anything holding money.
3. Stop reusing passwords at all
Nobody can remember a hundred unique passwords, which is why password managers exist. Use one — browser-built-in is fine, dedicated ones are better — and let it generate the passwords. You then remember exactly one.
This single change makes future breaches almost boring. One site leaks, one password is exposed, nothing else is affected.
4. Expect better phishing
After a breach, scam emails referencing that specific company will follow, because the attacker knows you had an account there. They are far more convincing than generic spam.
The defence is a habit rather than a skill: never act on a link in an email about account security. If a message says your account needs attention, close it and go to the site by typing the address yourself. That one rule defeats nearly all of it.
5. Reduce what a future breach can expose
You cannot stop companies being breached. You can limit what each one holds.
- Use a different address for signups you do not care about, so the leak is not tied to the address you use everywhere. A temporary address works for one-off signups; an alias is better for anything ongoing.
- Decline optional fields. If a shop does not need your date of birth, do not supply it.
- Delete accounts you no longer use. A dormant account is still a database row waiting to leak.
What Not To Panic About
Some things sound alarming and mostly are not:
- "Your data is on the dark web." Usually just means it appeared in a compiled list. It is not a targeted attack on you specifically.
- Sextortion emails quoting a real password. A well-known scam. They took a password from an old breach and are hoping the shock stops you thinking. There is no video. Change the password if you still use it, delete the message, do not reply and do not pay.
- Being in a breach from a company you have never used. Usually a service you signed up for once and forgot, or a company that acquired one you did use.
- Marketing emails claiming your identity is "at risk". Identity monitoring services have a strong incentive to alarm you. Some are useful. Read what you are buying before paying monthly for it.
Common Questions
Should I change my email address after a breach?
Almost never. It is a large amount of work — every account, every contact — and it fixes the symptom rather than the cause. Change passwords, enable two-factor authentication, and tighten how you hand the address out. Consider a new address only if the volume has become genuinely unusable.
How long does leaked data stay dangerous?
Passwords stop mattering the moment you change them. Everything else is permanent. Once a database is copied it is copied for good, which is why the useful response is limiting future exposure rather than trying to claw back the past.
Can I make a company delete my data?
In many places, yes — GDPR in Europe, similar laws elsewhere, and companies must respond within a set period. It is worth doing for services you have abandoned. But it removes you from their live database, not from copies already circulating.
Is it safe to enter my address into a breach checker?
Into the established one, yes — it is designed so the search reveals nothing useful, and it is a well-scrutinised service. Into a site you found in an ad, no. If it wants your password, it is a phishing page. No legitimate breach checker ever asks for a password.
What if my card details were in the breach?
Contact your bank now rather than waiting for a fraudulent charge. They will usually reissue the card. Watch the statement for small test transactions, which often precede larger ones. If identity documents were exposed too, ask about a credit freeze.
The Short Version
Check your addresses at Have I Been Pwned. Change any password you reused, starting with your email account. Turn on two-factor authentication. Start using a password manager so this stops being your problem. Treat any email about account security as suspect and navigate to sites yourself.
Being in a breach is not a personal failure — it is a near-certainty for anyone who has used the internet for a decade. What is in your control is making sure the next one is an inconvenience rather than a crisis.