Your email was in a data breach. What now?

If your email shows up in a data breach, it means a company you used lost data that included your email address, and possibly other things like your password, phone number or address. You can’t undo a breach. What you can do is make sure the data that leaked can’t be used to get into your accounts or find you.

Being in a breach is very common. It doesn’t mean you did anything wrong.

Find out what was exposed

Have I Been Pwned is a free service that lets you check an email address against known breaches. For each breach, it lists what kinds of data were exposed: email addresses, passwords, phone numbers, physical addresses, dates of birth and so on.

That list tells you what to do next. A breach that only exposed email addresses is mostly a spam problem. One that exposed passwords or phone numbers needs more attention.

What to do first

1. Change the password for that account, and anywhere else you used the same password. Reused passwords are how one breach turns into several hacked accounts.
2. Secure your email account. Your email can reset the password on almost everything else, so give it a strong, unique password.
3. Turn on two-step sign-in for your email first, then for any account that matters: banking, social media, work, your phone carrier. An app or security key is better than text messages.
4. Start using a password manager so every site gets its own password and you don’t have to remember them.

If your phone number or address was exposed

You can’t change your address easily, and changing your phone number is a pain. But you can be ready for what tends to follow:

• Expect convincing scams. Someone with your name, phone number and the name of a company you use can write a believable text or email. Don’t click links in messages about an account. Go to the site yourself.
• Protect your phone number. Ask your carrier about a port-out PIN or account lock, which makes it harder for someone to move your number to their own phone.
• Consider a credit freeze if your date of birth or Social Security number was exposed. In the US, freezing your credit at Equifax, Experian and TransUnion is free and makes it much harder for someone to open new credit in your name.

Why breaches matter for your privacy

Breaches aren’t only about passwords. They also connect things. A breach record can show that your personal email was used on a particular forum, which leads to an old username, which leads to a profile with your city. Breached phone numbers and addresses also end up in the data that people-search sites buy.

So a breach can be one step in a chain from something a stranger knows about you to something you’d rather they didn’t. See How someone gets from your username to your home address.

How Oko helps

Oko’s report checks your confirmed email addresses against known breaches and shows which ones you’re in and what kinds of data each exposed. It doesn’t show the leaked values themselves. Where a breach is part of a route to your home or phone, the report shows that route and what to fix first.