How to check if your details were in a data breach

What a data breach means for you

A data breach happens when criminals get hold of information a company stores about its customers. That might include names, email addresses, phone numbers, dates of birth, addresses and sometimes passwords. Our news section reports breaches regularly, such as the Gyazo breach and the Sony So-net breach covered in our latest weekly round-up.

Once leaked, this information is often shared or sold. Criminals use it in two main ways:

• Trying the password elsewhere. If you reused the same password on other sites, they can get into those accounts too. This is called credential stuffing.
• Convincing scams. A message that mentions your real name, address or recent order is more believable. See Spotting scam messages.

How to check

1. Use a well-known breach-checking service. Have I Been Pwned is a long-running, free service that tells you which known breaches include your email address. Type the address yourself into the official site.
2. Use your password manager's check. Most password managers, and the ones built into Chrome, Edge, Safari, iPhone and Android, can warn you about passwords that appeared in breaches or are reused.
3. Read official breach emails carefully. A company that was breached may email you. Do not click links in the message; go to the company's website or app yourself to read the notice.

Tip: Never type a password into a "check if your password leaked" website you found in an advert or email. Use your password manager or the browser's built-in check instead.

If your details were leaked

1. Change the password for the breached service.
2. Change it anywhere else you used the same or a similar password. This is the most important step.
3. Turn on 2-step verification, starting with your email. See 2-step verification.
4. Watch for targeted scams that mention the company or your details.
5. If financial details leaked, tell your bank, check statements and consider the bank's advice on replacing the card.
6. If ID documents leaked, follow the company's guidance and your country's official advice on identity fraud.

Reduce the damage next time

• Use a different password for every account, ideally created and stored by a password manager. See Strong passwords made easy.
• Consider passkeys where offered; they cannot be reused or leaked in the same way.
• Give companies only the information they really need.
• Close accounts you no longer use, so your data is not sitting in more places than necessary.

You are not to blame

A breach is the company's security failure, not yours. Many people feel embarrassed when their details appear in one, but it is extremely common. What matters is what you do next, and the steps above take less than an hour.