What to do after an email data breach
A breach listing is a reason to review the affected accounts, not proof that someone has logged in. Start with the accounts that matter most and take the steps that apply to the data reported.
1. Secure your email account first
If the email account itself may be affected, change its password to a new, unique one and turn on multi-factor authentication or a passkey if available. Review recovery addresses, phone numbers, forwarding rules, connected apps and recent sign-ins. Sign out sessions you do not recognise.
2. Replace reused passwords
If you reused the exposed password on other accounts, change it on each of them. Use a different, hard-to-guess password for every service; a password manager can help you keep them distinct. Do not reuse an old password with a small variation.
3. Match the response to the data types
An email address alone calls for extra care with unexpected messages. If a report lists financial or identity information, contact the relevant bank, card issuer or organisation using a phone number or website you already trust. Review account activity and statements for anything you do not recognise.
4. Be alert for targeted messages
Scammers may use a real service name or personal details to make a message convincing. Do not follow unexpected sign-in or payment links. Open the service through its official app or type its known address yourself, and verify unusual requests through a separate trusted channel.
5. Understand what a breach report can confirm
A source association does not confirm that an account was accessed or that the original organisation still has the data. Contact the organisation through its official privacy or security channel if you need to ask about a specific record. A scan cannot remove information from another service or guarantee its removal.