How to Check If Your Email Was in a Breach

If you have had a message saying your email address was caught up in a data breach, the first thing to know is that a leaked email address on its own is not the same as a hacked account. The National Cyber Security Centre (NCSC) advises you to contact the organisation that holds your details, using its official website or social media channels rather than any link in the message, and ask it to confirm the breach, how you are affected and what else you need to do¹.

Then work through the practical steps in order. Check whether your address appears in known breaches using a tool such as haveibeenpwned.com³. Change the password on the affected account, and on every other account where you used the same one, because if you reuse passwords a criminal only needs one to reach all your accounts⁴. Turn on 2-step verification for your email, which the NCSC calls the first and most important step in protecting an account if your password is compromised⁵.

Expect follow-up scam emails. Criminals exploit high profile breaches while they are still fresh in people's minds, even if your details were not stolen². The NCSC's advice is to stay calm and take a moment: forward suspicious messages to report@phishing.gov.uk and delete them⁶.

What to do first if your email was in a breach

Start by confirming the breach is real. The organisation should be able to confirm if a breach has actually occurred, how you are affected and what else you need to do¹. Contact it through its official website or social media channels, and do not use the links or contact details in any message you have been sent, because a breach notice is exactly the kind of email a criminal will imitate².

Next, look for signs that someone has already been in. Things to look out for include not being able to log into your accounts, or messages or notifications that you do not recognise sent from your account¹. Check your online accounts for unauthorised activity: changes to security settings, messages you do not recognise, logins from strange locations or at unusual times². If you spot any of these, treat it as a hacked account rather than a passive breach and follow the recovery steps below.

It also helps to understand why an email address matters so much. The NCSC warns that if a criminal can access your email account, they could access private information about you, including your banking details, post emails and messages pretending to be from you, and reset all your other account passwords⁴. Your inbox is the master key to almost everything else you do online, which is why the steps that follow concentrate on it.

Check whether your email appears in a known breach

To check if your details have appeared in public data breaches, you can use online tools such as haveibeenpwned.com³. The NCSC points to it directly, and notes that similar services are often included in antivirus or password manager tools, so you may already have a checker built into software you own².

A check tells you which breaches an address appears in. It cannot tell you that your account is currently compromised, and a clean result does not mean you can relax: it only covers breaches that are publicly known. Run the check for each email address you use, including older ones you rarely sign into but which may still be tied to accounts you care about.

What you do with the result depends on what was exposed. If a password was part of the leak, change it wherever you still use it. If the breach involved personal details, be alert for messages that reference them. The NCSC warns that scam messages after a breach typically contain links to websites that look genuine but which store your real details once you type them in, install viruses, or steal passwords you enter².

Change the password, and anywhere you reused it

If you have reused your email password across other accounts, change your email password as soon as possible, and make it strong and different to all your other accounts⁴. The reason is simple: if you use the same password across different accounts and one of them is compromised, a hacker can try the same password on your other accounts and potentially gain access to them too⁵. Put another way, cyber criminals only need one password to access all your accounts⁴.

Work through it in this order:

1. Change the password on the account that was breached⁸.
2. Change the password on every other account where you used the same one⁸.
3. If you entered banking or card details into a suspicious site, contact your bank straight away, and if you use online banking, cancel the card or cards there¹⁰.
4. If a suspicious message quotes a password you still use, change it as soon as you can, change any other accounts using the same password, and consider using a passkey instead².
5. Check your bank statements and online shopping accounts for unauthorised purchases or unusual transactions, contacting your bank directly through its official website or channels rather than links in messages⁸.

A password manager makes the "different everywhere" part manageable, because it can generate and store a separate password for each account⁵. If you would rather not use one, the NCSC's own suggestion is to combine three random words to create a password that is long enough and strong enough¹¹.

Turn on 2-step verification for your email account

Two-step verification, also called 2SV or two-factor authentication (2FA), usually works by sending you a PIN or code, often by SMS or email, to prove it really is you¹². The NCSC describes turning it on as the first and most important step in protecting an account if your password gets phished or otherwise compromised⁵. It is worth setting up on important accounts such as email and banking even if they are already protected by a strong password, and it only takes a few minutes⁸.

Do it for your email first, then for the accounts that matter most to you. The NCSC recommends 2SV for your most important accounts¹³, and lists it among the basic steps everyone can take, alongside a strong and separate password for email, installing the latest software and app updates, using a password manager, backing up your data, and choosing a password made from three random words¹².

If you are recovering an account rather than simply hardening one, the order matters. The NCSC's recovery steps include checking there are no unwanted forwarding rules in your email account, and then setting up 2SV¹². Forwarding rules come first because criminals set them up to receive copies of all emails sent to your account, which could allow them to reset your passwords even after you have changed them⁸. There is a separate guide to checking for forwarding rules set by hackers if you want the detail.

Scam emails that follow a breach, including sextortion threats

Be alert for suspicious messages after a breach has occurred, as cyber criminals may try to take advantage of it¹. Things to look out for include official-sounding messages about "resetting passwords", "receiving compensation", "scanning devices" or "missed deliveries"¹⁴. The NCSC also flags emails full of "tech speak" and messages urging you to act immediately³.

Sextortion is one form this takes. It is when a criminal attempts to blackmail someone, usually by email, claiming they have login details or a video of the victim visiting an adult website and threatening to disclose this unless the victim pays a ransom⁷. It is an example of a phishing attack, where victims receive emails that try to trick them into doing the wrong thing, and criminals send millions of them in the hope that someone will pay⁷.

If a sextortion email quotes a password, do not worry: it has probably been discovered from a previous data breach, which you can check at haveibeenpwned.com⁷. But you should change your account password immediately, and anywhere else you use the same password⁶. Then forward the email to report@phishing.gov.uk and delete it⁶. If you have already paid the ransom, visit Report Fraud at www.reportfraud.police.uk for further advice⁷, or report it to your local police force by calling 101¹⁵.

If a device has been infected: recovering it

A breached online account and an infected device are different problems. If you think a device has been hacked, or you opened a suspicious link, open your antivirus software if you have it and run a full scan, allowing it to clean up any problems it finds¹⁰. Keep your device and programs up to date, back up your data, check your device is encrypted, and on PCs and laptops make sure your antivirus is updating regularly¹⁶.

On a mobile device, apps that check whether it has been "rooted" or "jailbroken" can be a good indication of hacking if you have not done either yourself, though they are not a guarantee¹⁶. If you decide to wipe and reinstall, do not try to rescue data while the device is still infected, because that runs the risk of carrying the infection through after wiping and re-installing¹⁶.

Once the device is clean, work through the accounts you used on it. If you logged into any accounts or apps since installing malware, change the password for that account and update the same password on any other accounts, making sure they are unique¹⁷. Then set up 2SV on the accounts that matter¹². There is a fuller walkthrough in Malware on a Computer or Phone: Signs and Removal and a step-by-step list in the After Fixing an Infected Device checklist.

Where to get help and how to report

Reporting is quick and it helps the wider effort. Forward suspicious emails to report@phishing.gov.uk, send suspicious texts to 7726, and report scam websites¹⁰. The National Cyber Security Centre will investigate what you send¹⁸. You can forward as many suspicious emails as you like, and emails that merely feel suspicious will be checked¹⁹. Suspicious text messages should be sent to 7726, which is free²⁰, and you can also report suspicious emails or websites through the report suspicious emails, websites and phishing service on GOV.UK²¹.

If you are unsure whether a message is genuine, forward it rather than agonising over it. The NCSC's Suspicious Email Reporting Service exists precisely for the "not quite sure" category¹⁹. For a message that arrived on a work laptop or phone, contact your IT department and let them know¹⁰.

For anything that has already gone wrong, the NCSC publishes guidance on recovering a hacked account, and it is worth reading in advance so you know what to do if you experience an incident²². If money has gone, contact your bank directly through its official channels⁸. Our guides to what to do if an online account is hacked and how to recover a hacked email account take the recovery steps further, and Protecting Email and Bank Accounts covers the settings that stop a breach becoming a takeover.