You get an email saying your account was part of a data breach. Take a breath. Leaks are common, and a handful of simple, free steps handle most of the risk. The video above walks through them in about three and a half minutes; this page has the same checklist with sources.
What a data breach is
A data breach is when a company you use gets hacked or leaks its data by mistake. Your email, your password, and sometimes your phone number or address end up in a file that criminals copy and share. It usually isn't your fault, but what you do next matters.
How common leaks are
The free site Have I Been Pwned tracks known breaches. As of October 27, 2026 its counter listed more than 17 billion pwned accounts (17,846,896,404) from over a thousand websites (1,048). If your email shows up, you're in very large company.
Why a leaked password matters
Many people reuse passwords. Criminals take a leaked email and password and try them on other sites, such as your bank or shopping accounts. Verizon's 2025 Data Breach Investigations Report found that credential abuse was the most common way attackers got in, at 22% of breaches studied (more on credential stuffing).
Breaches and identity theft
Some breaches leak more, like a Social Security number or date of birth. That can lead to identity theft, where someone opens a credit card or loan in your name. In 2024 the FTC received about 1.1 million identity theft reports, and credit card fraud was the top type (449,032 reports), according to the Consumer Sentinel Network Data Book 2024 (PDF).
Step 1: Check Have I Been Pwned
Go to haveibeenpwned.com and enter your email. It shows which breaches included you and what leaked. You can also sign up for an alert if your email appears in a new one.
Step 2: Change reused passwords, and use passkeys
Change the password on the leaked site and on any site where you used the same one. Make each password unique; a password manager makes that easy. Better still, switch to passkeys where you can. They can't be leaked and reused like a password. See Passkeys vs Passwords: Why Phishing Stops Working.
Step 3: Turn on two-factor authentication
Turn on two-factor authentication, especially for your email and your bank. Then a stolen password alone isn't enough to get in. An authenticator app or a passkey is stronger than a text message code.
Step 4: Freeze your credit (free)
In the US, a credit freeze is free at all three bureaus: Equifax, Experian and TransUnion. A freeze stops anyone, including you, from opening new credit in your name. It doesn't affect your credit score, it lasts until you lift it, and you can lift it any time you need to apply for a loan. You have to place it with each bureau separately.
An alternative is an initial fraud alert: also free, it lasts one year, and you only need to contact one bureau. Details from the FTC: Credit freezes and fraud alerts and Free credit freezes are here.
Step 5: Watch for signs
- Check your bank and card statements.
- Get your free weekly credit reports at AnnualCreditReport.com.
- Be extra careful with emails about the breach itself. Scammers like to send fake breach notices, so go to the company's site directly instead of clicking links. (Using public Wi-Fi while you fix things? Read Is Public Wi-Fi Dangerous?)
If your identity was already used
Go to IdentityTheft.gov, the FTC's official site. It builds a free, step-by-step recovery plan and an official identity theft report. The FTC also explains the process in How to recover from identity theft.
Extra help (optional)
An identity theft protection service can monitor your information and help with recovery, and some people find that worth paying for. The free steps above still do most of the work.
Quick recap
- Check your email on Have I Been Pwned.
- Change reused passwords; use passkeys where you can.
- Turn on two-factor authentication.
- Freeze your credit at all three bureaus (free).
- Watch your accounts and credit reports.
Do it once, and you'll sleep better.
Sources
Frequently asked questions
How do I check if my email was in a data breach?
+
Go to haveibeenpwned.com and enter your email address. It shows which known breaches included it and what kind of data leaked. You can also sign up to be alerted if your email appears in a new breach.
Does a credit freeze cost money or hurt my credit score?
+
No. In the US a credit freeze is free, it does not affect your credit score, and it lasts until you lift it. You need to place it separately with each of the three bureaus: Equifax, Experian and TransUnion.
What is the difference between a credit freeze and a fraud alert?
+
A freeze blocks access to your credit report, so new credit generally can't be opened in your name until you lift it. An initial fraud alert is also free, lasts one year, and asks lenders to verify your identity; you only need to contact one bureau to place it.
What should I do if someone already used my identity?
+
Go to IdentityTheft.gov, the FTC's official site. It creates a free, step-by-step recovery plan and an official identity theft report.
