What to do after your email appears in a data breach

The National Cyber Security Centre (NCSC) defines a data breach as information held by an organisation being stolen or accessed without authorisation. Appearing in a breach list means your email address was in that data. What else was exposed depends on the breach: it might be only email addresses, or it might include passwords, names, phone numbers or other details.

The NCSC notes that criminals use breached information to make scam messages look genuine, and that suspicious messages can arrive well after a breach is public. Have I Been Pwned (HIBP), a free breach-lookup service, also says that changing your password does not remove a breach from your record: the exposure is a historic fact, and the useful response is to act on what was exposed.

1. If you can still sign in to your email, secure it now. Give it a strong password that you use nowhere else and turn on 2-step verification (2SV). Email can reset your other accounts, so it matters most. If you cannot sign in, or you see settings or messages you did not make, follow the NCSC guidance on recovering a hacked account (opens in a new tab).
2. If the breach included passwords, or you cannot tell, change the password on the breached service. If you used that password anywhere else, change it on those accounts too, starting with banking and anything that holds payment details. Attackers often try a stolen password against other services.
3. Check your bank and card accounts for anything you do not recognise. If you have lost money, tell your bank straight away and report the crime to Report Fraud (in Scotland, contact the police by calling 101).
4. Turn on 2-step verification on your other important accounts: banking, social media and online shopping. Where a service offers a passkey, the NCSC recommends using it as your first choice of sign-in.
5. Check the organisation's own statement by going to its official website or social media, not to a link in a message. The NCSC says to do this because messages about breaches are often fake. The organisation should confirm whether a breach happened and what you need to do.
6. Watch your messages. Be sceptical of anything about password resets, compensation, missed deliveries or "scanning your device", and of anything that pressures you to act quickly. A bank or other official organisation will never ask you to supply personal information in this way.
7. Later, tidy up. Close accounts you no longer use at the breached service and elsewhere, and consider asking the breached organisation what it holds about you.

• Emails: forward them to the NCSC's Suspicious Email Reporting Service.
• Texts: forward them to 7726, which is free.
• Calls: hang up and contact your phone provider.

The NCSC suggests online tools such as haveibeenpwned.com for checking whether your details have appeared in breaches, and notes that antivirus and password manager tools often include similar services. HIBP says nothing is explicitly logged by its website when you search, and that sensitive breaches are not publicly searchable: only the verified owner of an address can see them, after signing in and proving access to it.

You can check a password as well as an address. See Checking password exposure without sharing a password unnecessarily.