How to Check If Your Email Was Exposed in a Breach
Matthew Leo · Published August 9, 2026 · Guides
Your email address may appear in an old data breach even when nobody has taken over your inbox.
That can still be dangerous. Criminals reuse leaked passwords, combine old personal details with new scams and wait for the moment when a believable message will work. The safest response is to check with a trusted breach service, understand what was exposed and protect the accounts that matter most.
You do not need to pay a stranger to search the “dark web,” and you should never type your current password into a random breach-checking website.
Start with Have I Been Pwned
Have I Been Pwned, often shortened to HIBP, is a well-known breach-notification service created by security researcher Troy Hunt. Enter an email address in its search box and it lists known breaches in which that address appeared.
The email search does not ask for your password. HIBP says it does not store exposed passwords beside email addresses. Its separate Pwned Passwords tool can check whether a password has appeared in known leaks, but a normal email search is enough for this first review.
Read each result instead of stopping at the red warning. Look at the date, the service involved and the types of data exposed. An email-and-name leak creates a different risk from a breach that included passwords, phone numbers, addresses or security questions.
What a positive result means
A result means the address appeared in a breach data set known to HIBP. It does not prove that someone currently controls your email account. It also does not prove that the listed company was the only place from which the data could have spread.
An old breach will remain in the history after you change the password. The record describes what happened; it is not a live test of the account.
A clean result is reassuring but not a guarantee. HIBP notes that many breaches are never discovered, never made public or never added to its service. Treat “not found” as one useful signal, not a certificate of safety.
Protect the email account first
Your main inbox is often the reset key for banking, shopping, social media and cloud storage. If a leaked password was reused, secure the email account before working through less important services.
- Use a clean device. If you suspect malware, change credentials from another phone or computer first.
- Create a new, unique password. Do not make a small change to the exposed password. A password manager can generate and store a different password for every account.
- Turn on multi-factor authentication. An authenticator app, security key or passkey is generally stronger than an SMS code when the service supports it.
- Review recovery details. Remove unknown phone numbers, backup email addresses and security questions.
- Sign out unfamiliar sessions. Check the provider’s device or sign-in history and remove anything you do not recognize.
- Look for hidden forwarding rules. An attacker may create a filter that silently sends password-reset messages elsewhere.
If the old password was used on several sites, change every copy. The Office of the Privacy Commissioner of Canada warns that credential-stuffing attacks test stolen logins across many services until one works.
Match the response to the leaked data
If the breach included payment information, contact the bank or card issuer and monitor transactions. If it included a driver’s licence, health card, passport or immigration document, contact the organization that issued it for the correct next step.
If a Social Insurance Number or enough identity information was exposed, consider contacting both Canadian credit bureaus and asking about alerts on your file. Review your credit reports for accounts you did not open.
The federal privacy commissioner recommends keeping the original breach notice, watching affected accounts and staying alert over time. Fraudsters may wait until the first attention around a breach has faded.
Watch for the second scam
A breach often creates a second wave of fake support messages. A criminal may know the company name, your email address and a partial phone number, which makes the message feel real.
Do not use the login link in an unexpected breach notice. Open the company’s app or type its known address into the browser. A real company should be able to explain what information was involved, what it has done and how affected people can reduce the risk.
If money was stolen or someone used your identity, contact the financial institution, local police where appropriate and the Canadian Anti-Fraud Centre.
Make the next breach less damaging
No company can promise that it will never be breached. You can limit how far one leak travels by using unique credentials, deleting accounts you no longer need and storing less payment or identity information in shopping profiles.
Sign up for breach notifications on email addresses you still use. Then treat the alert as a prompt to inspect the facts, not as proof that disaster has already happened.
Mapletechie’s practical guides focus on actions ordinary people can finish without buying fear-based security products.
The best breach check takes only a minute. The valuable part is what comes after: one strong email account, no reused passwords and a plan for the personal information that cannot simply be changed.