What Should I Do If My Email Appears in a Data Breach?

First: confirm what was actually exposed

Before doing anything else, find out which specific breach it was and what data category was involved — email only, or email plus password, or something more serious like financial details. This determines everything that follows. Reacting the same way to a low-severity contact-data leak and a high-severity credential leak wastes effort where it's not needed and under-reacts where it is.

Step 1: Change the password on the breached account — and anywhere it's reused

This is the single most important action if the breach included a password. Change it on the breached service first, then think honestly about every other account where you've used the same or a similar password. This second part is the one people skip, and it's usually the one that actually matters — breach data gets tested against other popular services automatically by attackers, a technique called credential stuffing.

Step 2: Turn on two-factor authentication

If the breached account (or any important account) doesn't already have 2FA enabled, turn it on now. Even if your password does get compromised again in the future, 2FA is what stops that from turning into an actual account takeover.

Step 3: Check your email's own security

Your email is usually the recovery point for everything else you own online. If it wasn't already secured with a strong, unique password and 2FA, this is the moment to fix that — a compromised email can cascade into every account that uses it for password resets.

Step 4: Watch for follow-up phishing

Breached email addresses are frequently targeted with phishing campaigns referencing the breach itself ("Your account was compromised — click here to secure it") or the service it came from. Be specifically skeptical of urgent-sounding emails arriving in the weeks after you learn of a breach — this is a predictable, common follow-up.

Step 5: Check whether the breach included anything requiring bank or ID-level action

If financial details or government ID numbers were part of what leaked, this moves beyond password hygiene:

• Contact your bank about the specific account if card or banking details were exposed.
• Consider Aadhaar locking through UIDAI if Aadhaar data specifically was part of the leak.
• File a report at cybercrime.gov.in or call the National Cyber Crime Helpline (1930) if you suspect active misuse, not just exposure.

Step 6: Decide whether to close the account

If it's a service you no longer use, this is a reasonable moment to formally delete the account rather than just changing the password and moving on — reducing your ongoing exposure rather than just patching this one incident.

What not to do

Don't change your email address entirely unless the situation is severe and ongoing — it's a heavy step that disrupts far more than it protects against for a single breach. And don't ignore it because "it's just my email" — email addresses are the connective thread across your accounts, and treating a leak as harmless is how smaller incidents turn into bigger problems later.

Keep a habit of checking going forward

One breach response doesn't cover future ones. Signing up for free breach alerts (Have I Been Pwned offers this) and periodically running a broader check — across broker sources too, not just known breaches — keeps you ahead of new exposure instead of finding out only when something goes wrong. Scan My Shadow's report checks your email and phone number across 1,500+ sources, giving you a periodic, fuller picture beyond single-breach alerts.

Related Reading

• What Does Your Email Address Reveal About You? — what your address pattern gives away even before any breach happens.
• How to Check If Your Email Has Been Leaked — the check worth running before deciding what to do next.
• Have I Been Pwned India: Check If Your Email Was Leaked — a walkthrough for Indian users specifically.
• Password Leaked? What to Do Now — the password-specific version of this same checklist.
• Stealer Logs vs Data Breaches — why some leaks are more serious than others.

Got an actual breach notification email rather than a search-tool alert? See What a Data Breach Notification Email Actually Means for how to read it.

Curious what's already out there about you? Scan My Shadow checks your phone number and email across 1,500+ sources and sends you a clear report — no guesswork, just facts. Start your scan.