Guide Guides

Data breach: my email or password was leaked – what to do now

An email arrives saying a company you use has “experienced a security incident”. Or you typed your address into Have I Been Pwned and got a red list of breaches. That doesn't mean someone is in your account. It means your details are out there, and sooner or later someone will try to use them: your password on other sites, your email and phone number for targeted scams. Here's what to do right away, what to do this week, and what to watch for in the months after.

Kyberkit editorial team · 10 November 2026 · reading time 7 minutes

Key points

Password leaked? Change it on that service and anywhere you used the same or a similar one. Attackers try leaked passwords on other accounts.
Only your email, name or phone number leaked? You don't need a new password, but expect targeted phishing – the scammer knows more about you, so the message will be more convincing.
Check any breach notice on the company's own website. A “breach notification” can itself be a phishing email with a fake sign-in link.
Have I Been Pwned shows where your address has leaked. Unique passwords, a password manager and 2-step verification limit the damage from the next breach.

What leaked matters

A data breach means a service's database (an online shop, forum, app or company) ended up with someone who shouldn't have it. From what we see in a SOC: in most breaches, nobody raids your account straight away. The data is sold, merged with other breaches and used for months or years – mainly for two things: trying your password on other sites, and targeted phishing.

What leaked	The risk	What to do
Password (even hashed)	It gets tried on your email, bank and social media	Change it on that service and everywhere you reused it
Email, name, phone number	Targeted phishing and scam calls that use your name	No new password needed; be extra careful with messages and calls
Address, date of birth, ID numbers	More convincing scams, identity fraud attempts	Watch your credit report, never confirm details over the phone
Card number	Unauthorised payments	Call your bank, block and replace the card

The company's notice should say what was in the breach. For breaches listed on Have I Been Pwned, every entry shows the exposed data (“Compromised data”).

How leaked data gets used

Do this now

Check the breach notice outside email. Go to the company's website or app yourself. The UK's NCSC advises against using the links or contact details in any message you've been sent – breach notices are a popular phishing disguise.
Change your password on the affected service if passwords were exposed, or if the company doesn't know. The NCSC suggests switching to a passkey where one is available.
Change it everywhere you used the same or a similar password. This is the step that matters most: a password stolen from one poorly secured site gets tried on others. Start with your email and bank, then social media and shops with a saved card.
Turn on 2-step verification, especially for your email. With it, a password alone isn't enough. How-to: Two-step verification: how to turn it on.
Card details leaked? Call your bank on the number on your card or in your banking app and block the card.

This week: check your accounts

The NCSC recommends going through the accounts where you used the same password and looking for signs of unauthorised access:

you can't sign in, or security settings (recovery phone, recovery email) have changed,
your sent folder or social media shows messages you didn't write,
the sign-in history shows devices or locations you don't recognise, or logins at unusual times,
your email has a forwarding rule or filter you didn't create.

If you find any of these, it's no longer just a breach – the account has been hacked. Follow our guide My account was hacked.

Find out where else your address has leaked

Have I Been Pwned (HIBP) is a free service the NCSC recommends for this. Enter your email and you'll see the known breaches it appears in and what data each one exposed. A few things worth knowing:

A hit doesn't mean you've been hacked. HIBP shows that your address was in a leaked database, not that someone is in your account.
Alerts for new breaches. HIBP can email you when your address shows up in a new breach. You can only monitor an address you control – the confirmation goes to it.
The password check is built to be safe. According to HIBP's documentation, Pwned Passwords sends only the first 5 characters of the password's SHA-1 hash and does the rest of the comparison on your side. HIBP's advice: a password found in a breach should no longer be used.
Don't type passwords into other sites. A page that wants your full password “to check for leaks” may be a trap itself.

Many antivirus products and password managers offer a similar breach check – the NCSC mentions them as an alternative.

What to expect: scams after a breach

Leaked data fuels targeted scams. A message or call that knows your name, phone number or last order is far more convincing. The NCSC warns that phishing linked to a breach can arrive long after the breach was in the news.

Fake “breach notifications” with a link to reset your password or “verify your account” – always sign in through a website or app you open yourself.
Blackmail emails quoting an old password (“I have a video of you”). The password comes from a breach; there is no video. See Sextortion email: what to do.
Calls “from your bank” or “the police” that already know your details. Your bank won't ask for your login details or tell you to move money – see Bank impersonation scam calls.
Texts about a parcel or payment sent to a number leaked from an online shop – see Parcel delivery scam texts.

Not sure about a link in a message? Paste it into the link checker – it shows where the link really goes and whether the address imitates a well-known brand.

If personal details or ID leaked

If your address, date of birth or ID numbers leaked, watch for credit taken out in your name. In the US, the FTC explains that a credit freeze stops anyone opening a new credit account in your name while it's in place (you contact each of the three credit bureaus), and an initial fraud alert is free, lasts a year and tells businesses to check with you before opening an account. If someone has already used your identity, IdentityTheft.gov builds a personal recovery plan. Elsewhere, check your credit report with your country's credit reference agencies.

What the company has to do

Under GDPR (as summarised by the European Data Protection Board), which applies in the EU and – in its UK version – in the UK:

the organisation must report a personal data breach to the data protection authority within 72 hours of becoming aware of it, unless it's unlikely to put people at risk,
it must tell you without undue delay if the breach is likely to result in a high risk to you,
the notice should explain in plain language the likely consequences, what the organisation has done, what it recommends you do, and give a contact point (its data protection officer or another contact).

If a company won't tell you what happened, you can complain to your data protection authority. In the US, notification rules come from state law and vary.

If the breach has cost you money or someone is impersonating you, report it to your bank and to the police or national fraud reporting service.

Get ready for the next breach

Breaches will keep happening and you can't stop them. You can limit what they cost you:

A different password for every service. A leaked password then opens only one account. In practice that takes a password manager.
2-step verification or a passkey on your email, bank and social media.
HIBP alerts for your main email addresses.
Less data, fewer leaks. Close accounts you don't use; when signing up, give only what the service really needs.
Sign in only through your own route – a bookmark, the app, or a typed address. Never through a link in a message.

FAQ

Have I Been Pwned found my email in several breaches. Has my account been hacked?

Not necessarily. It means your address (and sometimes other details) was in a database that leaked from a particular service. For each breach, HIBP lists what kind of data was exposed. If passwords were included, change that password on the service and everywhere you reused it. If not, you don't need a new password, but expect scam messages sent to that address.

Is it safe to type my password into Have I Been Pwned?

HIBP's password check (Pwned Passwords) is designed so your password never leaves your device: according to its documentation, the password is turned into a SHA-1 hash and only the first 5 characters of that hash are sent; the comparison happens on your side. Don't type real passwords into other sites that offer to “check if your password leaked”. HIBP's advice is that a password that has appeared in a breach should no longer be used.

A company emailed me about a breach and asked me to reset my password via a link. Is it genuine?

It might be, but don't use the links or contact details in the message – that's the NCSC's advice. Go to the company's website or app yourself and change your password there. Scammers send fake breach notices precisely because real breaches are in the news and people expect them.

Does a company have to tell me about a breach?

In the EU and UK, under GDPR, an organisation must report a personal data breach to the regulator within 72 hours and tell you without undue delay if the breach is likely to result in a high risk to you. The notice should describe the likely consequences, what the company has done, what you should do, and give a contact point (EDPB). Rules elsewhere differ – in the US, breach notification is set by state law.

My address and date of birth leaked too. Could someone open credit in my name?

The more a fraudster knows about you, the higher the risk. In the US, the FTC explains that a credit freeze stops anyone opening a new credit account in your name while it's in place, and a free fraud alert asks businesses to check with you first; IdentityTheft.gov gives a recovery plan if it happens. Elsewhere, check your credit report with the credit reference agencies in your country.

Sources

Spotted a mistake? Let us know and we will correct it openly.