Am I in a Data Breach? How to Check and What to Do
To find out whether you are in a data breach, search your email address at Have I Been Pwned (HIBP), a free service run by Troy Hunt since 2013. If it lists a breach, change that password everywhere you used it, turn on multi-factor sign-in, and watch for phishing.
A clean result is not a guarantee: HIBP itself says it holds only a subset of breached records. PlayCISO is not affiliated with HIBP; we describe it from its own documentation.
Updated 3 November 2026
What Have I Been Pwned is and is not
- Free: it describes itself as a free service for people to assess risk.
- Source of data: breaches in which data was exposed to people who should not have seen it.
- No passwords shown: email addresses are loaded without passwords.
- Sensitive breaches: breaches where being listed could harm someone are not publicly searchable. Only the verified owner of an address can see them after signing in.
- Not exhaustive: only a subset of breached data is in there.
Two separate checks exist: an email address search and Pwned Passwords, which checks a password using k-anonymity (only the first five characters of its SHA-1 hash leave your device). A match means the password has appeared in a known breach and should never be used.
If you are in a breach: a checklist
- Identify the accounts. Note which breach and which service. Change the password there first.
- Change reused passwords. Anywhere you used the same password, change it. Use a password manager to make each one unique.
- Turn on stronger sign-in. Multi-factor authentication, or passkeys where offered.
- Check for misuse. Look for sign-ins and activity you do not recognise, and revoke old sessions.
- Expect phishing. Attackers use leaked details to sound credible. Do not follow links in unexpected messages; go to the site directly.
- If financial or ID data was exposed (US), follow the steps in Identity theft: what to do, including a free credit freeze.
- Subscribe to alerts with HIBP's Notify me so you hear about future breaches.
If you run a company
Staff credentials appearing in a breach is a response scenario, not just a personal one. Rehearse with the Leaked Credential Response tool, read our breach-lookup roundup, and remember that a criminal group's claim about your data is unconfirmed until verified; see the dark web guide.
Last reviewed 3 November 2026. HIBP features can change; check haveibeenpwned.com for current behaviour. General information, not legal advice.
Frequently asked questions
What is Have I Been Pwned?
A free website that lets people check whether an online account of theirs has been “pwned”, meaning compromised in a data breach. Troy Hunt created it and has run it since 2013, after the Adobe breach. PlayCISO is not affiliated with it.
Does Have I Been Pwned show my password?
No. Its FAQ says breached email addresses are loaded without their passwords and that it will not send exposed passwords to anyone, because doing so would put users and the site at greater risk.
If my email is not found, am I safe?
Not necessarily. HIBP states it holds only a small subset of breached records, so absence of evidence is not evidence of absence. Use unique passwords and multi-factor sign-in regardless.
What is the difference between a breach and a paste?
HIBP defines a breach as data inadvertently exposed in a vulnerable system, and a paste as information shared on sites such as Pastebin. Finding your address in a paste does not by itself mean a breach occurred, so review it.
Is it safe to check a password?
HIBP’s Pwned Passwords hashes the password locally with SHA-1 and sends only the first five characters of the hash. The matching hash suffixes come back and the final comparison happens on your device. You can check this in your browser’s developer tools. Even so, do not type a password you currently use into any site you do not trust.
What should I do if my email is in a breach?
Change the password on the breached site and anywhere you reused it, use a unique password per account, turn on multi-factor sign-in or passkeys, review account activity, and watch for phishing that uses the leaked details. HIBP also says to stop using any password found in Pwned Passwords.
Can I sign up for alerts?
Yes. HIBP’s Notify me service emails the address you verify; notifications go only to that address, so you cannot monitor someone else’s.
Can I remove my address from a breach listing?
HIBP says breach records cannot be erased from history even after a password change, but you can opt out so that a breach does not appear publicly against your address.