You can check in about 30 seconds whether your email address appeared in a known data breach, using a free tool called Have I Been Pwned. If it did, the fix takes about half an hour: change the affected passwords, turn on two-factor login, and watch for scams that use your leaked details.
- Most people are in at least one breach. Finding your email in a list is common and fixable, not a disaster.
- The real danger is reused passwords. Criminals take a leaked email and password and try them on banks, email and shopping accounts.
- Check only on the real site. Fake “breach checker” pages exist to steal your details.
- Act in this order: email account first, then banking and shopping, then everything else.
- Expect follow-up scams. After a breach, phishing texts, fake support calls and extortion emails often use your real data to sound convincing.
What is a data breach, and why should you care?
A data breach happens when information held by a company or service is exposed to people who should not have it. Hackers may break in, an employee may make a mistake, or a database may be left open on the internet without a password. The exposed data can include email addresses, phone numbers, home addresses, dates of birth, passwords, ID numbers and payment details.
You do not need to have done anything wrong. If a shop, forum, app or airline you once signed up for is breached, your details can be exposed even if you have not used the account for years.
Criminals run automated attacks called credential stuffing. They take leaked email and password pairs and try them on hundreds of other websites. If you used the same password in two places, one breach can unlock both accounts.
Leaked data also fuels scams. The FBI’s 2025 Internet Crime Report recorded about $122.5 million (roughly AED 450 million) in extortion losses, and approximately 4,700 account takeover complaints with losses of about $359.7 million (around AED 1.3 billion), according to a summary of the report. Scammers often combine leaked details with fake messages that look personal. That is why a breach check is one of the cheapest forms of protection available.
How to check if your email was in a data breach
The most trusted free tool is Have I Been Pwned (HIBP), created by security researcher Troy Hunt. It collects data from publicly known breaches and lets you search for your own email address or phone number.
Type the address yourself
Open a new browser tab and type haveibeenpwned.com directly. Do not click a link from an email or text that says “check if you were hacked.” Fake lookalike sites collect the details you enter.
Search your email address
Enter your email in the search box and press the button. In a few seconds you will see either a green message saying no breach was found or a red message listing the breaches that include your address.
Repeat for every address you use
Check your personal email, your work email, old addresses you no longer read, and any address you use for banking or shopping. Many people are in a breach on an old address they forgot about.
Check your passwords too
HIBP has a separate Pwned Passwords tool. It tells you whether a password has appeared in breaches, without storing it next to your name. If a password you use appears there, stop using it everywhere.
Turn on breach alerts
Use the “Notify me” option to get an email when your address appears in a future breach, so you do not need to remember to check again.
Scammers copy the look of breach-checking sites to steal email addresses, and sometimes passwords. Never enter your password on a breach-check site. A real checker only needs your email address.
Other places to check
- Your browser or phone. Google Password Manager, Apple’s Passwords app and most password managers can warn you when a saved password appears in a breach. Turn this feature on.
- The company itself. Companies that are breached often email affected customers. Verify any such email by visiting the company’s official site, not by clicking its link. Our guide on checking whether a website is legit shows how.
- Your bank or card provider. Many banks monitor for leaked card numbers and will replace the card for you if they see exposure.
HIBP only knows about breaches that have been collected and added. A “no breach found” message means your address is not in the data it has, not that your data has never leaked. Keep good habits either way.
How to read your results
If your email appears in one or more breaches, HIBP shows the name of each service, the date of the breach and the types of data exposed. Focus on the data types, because they decide what you must do.
| Data exposed | Risk level | What to do |
|---|---|---|
| Email address only | Low | Expect more spam and phishing. Use filters, and never click unexpected links. |
| Email and password | High | Change that password now, and everywhere you reused it. Turn on two-factor login. |
| Phone number | Medium | Expect scam texts and calls. Do not reply to unknown senders. See fake text message scams. |
| Date of birth, home address | Medium to high | Used for identity fraud and convincing scam messages. Watch for unusual requests. |
| Passport, ID, social security or tax numbers | Very high | Contact the relevant authority. Consider a fraud alert or credit freeze where available. |
| Card or bank details | Very high | Call your bank, block the card and review statements. |
| Security questions and answers | High | Change them on every account where you used the same answers. |
Also look at the date. An old breach in which you have since changed the password carries much less risk than a recent one. Even so, any password you have ever reused should be replaced.
The 8-step fix, in priority order
Do these in order. The first three steps stop most of the damage.
Secure your main email account first
Your email is the key to everything, because “forgot password” links go there. Change its password to a long, unique one, and turn on two-factor login. Then check the settings for unknown forwarding rules, linked devices and recovery phone numbers or addresses you do not recognize.
Change the password on the breached account
Go to the service directly by typing its address, log in, and set a new password. Log out of all other devices if the service has that option.
Replace every reused password
Think of every site where you used the same or a similar password. Start with banking, payment apps, shopping, social media and work accounts, and give each its own password.
Turn on two-factor login everywhere it is offered
Prefer an authenticator app, a passkey or a security key over text-message codes (see the comparison below). Never share a code with anyone who contacts you, whoever they claim to be.
Review your money
Check bank and card statements for unfamiliar charges. If card details were exposed, ask the bank to replace the card. Cancel and re-create any automatic payments linked to the old card.
Watch for follow-up scams
Expect texts, calls and emails that mention real details about you. Treat every unexpected message as suspicious until you verify it through an official channel.
Close accounts you no longer use
Old accounts are a breach waiting to happen. Delete or deactivate services you stopped using, and remove saved cards from shopping sites.
Set up breach alerts and a routine
Subscribe to alerts, check your addresses twice a year, and review your password manager’s security report.
Passwords that hold up
You do not need to memorize dozens of strange strings. You need three habits.
One password per account
This single rule stops credential stuffing. If one site is breached, the others stay safe.
Long beats complicated
A passphrase of four or more unrelated words, such as “river tulip copper window,” is easier to remember and harder to guess than a short, clever password.
Use a password manager
It creates and stores unique passwords for you, fills them in on the right sites only, and warns you about breaches. You remember one strong master password.
Consider passkeys
A passkey logs you in with your device’s fingerprint, face or PIN instead of a password. Where a site offers it, passkeys cannot be stolen in a typical phishing attack.
Do not use your name, birthday, phone number, “123456,” “password” or keyboard patterns. Do not add a number to an old password (“Summer2026!”) and call it new. Do not store passwords in a note on your phone or in an email to yourself.
Two-factor login compared
Two-factor authentication (2FA) asks for something beyond your password, so a stolen password is not enough. Not all methods are equally strong.
| Method | Strength | Notes |
|---|---|---|
| Passkey or hardware security key | Strongest | Resists phishing. Best for email, banking and important accounts. |
| Authenticator app | Strong | Codes generated on your phone. Much safer than text messages. |
| Text-message (SMS) code | Better than nothing | Can be intercepted or tricked out of you. Use if nothing else is offered. |
| Email code | Weaker | Only as safe as your email account, so secure that first. |
| No second factor | None | One leaked password opens the account. |
Whatever method you choose, save the backup codes in a safe place, such as your password manager, so you do not get locked out.
Scams that follow a breach
After a breach, criminals use your real details to build trust. Here are the most common patterns.
“I have your password and I recorded you”
An email quotes a real old password of yours and threatens to release embarrassing material unless you pay, often in cryptocurrency. The password came from an old breach. The threat is almost always a bluff. Do not pay, do not reply, change that password everywhere, and report the email.
“This is your bank’s fraud department”
A caller knows your name, partial card number or address and says your account is under attack. They ask you to read out a code or move money to a “safe account.” Real banks never ask for a one-time code or a transfer to a safe account. Hang up and call the number on the back of your card.
“Your data was leaked. Click to secure your account.”
A message imitates a company, and the link leads to a fake login page. Go to the company’s official website by typing the address instead.
If you want to go deeper on spotting these tactics, read our guides on fake text message scams and how to catch AI hallucinations, since AI tools can also give wrong contact details for banks and support lines.
Protecting your money and identity
If the breach exposed ID numbers, birth dates or financial details, take a few extra steps.
In the United States
- Get your free credit reports at AnnualCreditReport.com and review them for accounts you did not open.
- Place a fraud alert (initial alerts last one year and are free to renew) or a credit freeze, which blocks new credit until you lift it. Both are free, and you can use both together.
- Report identity theft and get a recovery plan at IdentityTheft.gov, and report scams at ReportFraud.ftc.gov.
- File your taxes early to reduce the risk of tax identity theft.
Anywhere
- Tell your bank immediately if card or account numbers were exposed.
- Cancel and re-create automatic payments after your card is replaced.
- Contact the authority that issued any exposed ID, such as a passport or driver’s license office, and ask what to do.
- Keep notes of the date, the company, and who you contacted.
If you live in the UAE
- Call your bank first if card or account details were exposed, and use your bank app to block or replace the card.
- Check your credit report. The Al Etihad Credit Bureau (AECB) holds credit reports for UAE residents, and reviewing yours helps you spot loans or cards you did not take out. Check the AECB’s official website for how to request a report.
- Report cybercrime. In Dubai, call Dubai Police on 901 or use the eCrime platform. In Abu Dhabi, call the Aman service on 800 2626.
- Know your rights. The UAE has a federal personal data protection law (Federal Decree-Law No. 45 of 2021). It gives individuals rights to access, correct and request erasure of their personal data, and requires organizations to notify authorities and affected people of a breach. Implementation details and deadlines depend on regulations, so check the UAE government portal (u.ae) and the official regulator for the current rules.
- Be careful with official-looking messages. Fake messages about fines, Emirates ID and visas often use leaked personal details. Verify through official apps and websites only.
Phone numbers, procedures and regulations can change. Confirm them on the official website of each authority before relying on them.
Your 30-minute breach plan
Minutes 0 to 5: Check
Look up every email address you use at haveibeenpwned.com and write down which services appear.
Minutes 5 to 15: Secure email
Change your main email password, turn on two-factor login, and review forwarding and recovery settings.
Minutes 15 to 25: Replace key passwords
Change passwords on banking, payment apps, shopping and social media. Use a password manager to create each one.
Minutes 25 to 30: Set alerts
Subscribe to breach notifications and turn on your phone or browser’s password breach warnings.
Put a reminder in your calendar every six months to check your addresses, review your password manager’s security report and delete old accounts.
Frequently asked questions
How do I check if my email was in a data breach?
Type haveibeenpwned.com into your browser, enter your email address and read the results. It will list any known breaches that include that address and the types of data exposed.
Is Have I Been Pwned safe to use?
It is a long-running, widely trusted service. It only needs your email address, never your password. Make sure you type the web address yourself, because fake lookalike sites exist.
My email was in a breach. Am I hacked?
Not necessarily. It means data from a service you used was exposed. You are at risk mainly if the exposed data included a password you reuse, so change those passwords and turn on two-factor login.
Should I change all my passwords?
Change the passwords for your email, banking, payment, shopping and social accounts first, along with any password you reused. A password manager makes this far quicker.
What is the safest type of two-factor login?
Passkeys and hardware security keys are the strongest, followed by authenticator apps. Text-message codes are weaker but still better than no second factor.
An email says it has my password and demands payment. What do I do?
Do not pay or reply. The password almost certainly came from an old breach, and the threat is usually a bluff. Change that password everywhere you used it, and report the message.
How often should I check?
Subscribe to breach alerts so you are told automatically, and do a manual review of your accounts about twice a year.
Protect the next account too
Learn how to spot fake websites, text scams and AI errors before they cost you.
Sources
- Have I Been Pwned
- ConsumerAffairs: What to do after a data breach
- CyberScoop: Cybercrime losses jumped 26% to $20.9 billion in 2025 (FBI IC3)
- SlowMist: Analysis of the FBI’s 2025 Internet Crime Report
- ReportFraud.ftc.gov · FBI IC3
- Securiti: UAE Personal Data Protection Law overview · UAE Government Portal
Currency conversions use the fixed rate of about AED 3.67 per US dollar. This guide is for general information and is not legal or financial advice. See our Disclaimer and Editorial Policy.