Change Your Email After a Breach? Only in These 3 Cases

Should you change your email address after a data breach? Rarely. Change the password, switch on two-step login, and keep the address.

That’s the answer I give friends who message me in a panic at 11pm. It’s also the one most people don’t want to hear, because getting a new address feels like doing something.

There are three real exceptions, and all three are below, with what to do in each case.

You’ve lost the mailbox and can’t get it back. The address sits on a domain you no longer control. Or the address itself now puts you in danger.

Quick context if you’re new here. I run XposedOrNot, a free, open-source breach checker. You type in an email address, and it shows which public breaches it appears in, and a click on any of them tells you what that breach exposed.

The first-party numbers in this post come from our catalog of 786 breaches, pulled on 1 October 2026. The outside numbers come from peer-reviewed studies, the FTC and the big mailbox providers, with links at the end.

The short version

• A breach leaks your address. The damage comes from what leaked next to it, and 268 of our 786 breaches had no password in them at all.
• Changing the address doesn’t pull it out of the old files. The typical breach in our catalog happened nearly seven years ago.
• The three exceptions: the mailbox is gone, the domain isn’t yours, or the address itself puts you at risk.

Why a breach usually isn’t a reason to change your email

Think of the address as the label on the door, and the password as the key.

A breach hands strangers the label. With a label, they can send you phishing mail, spam you, and try the key from that breach on other doors. None of that gets better if you move house and tell the same people your new address.

So what actually leaked next to your email? This is our whole catalog, every breach counted once:

Also in the breach	Breaches	Share of 786
A password	518	65%
Your name	412	52%
A username	395	50%
Your phone number	277	35%
Your IP address	276	35%
Your home address	220	27%
Your date of birth	197	25%

(Breaches, not people. One address can sit in dozens of these, so nothing here is a headcount.)

Look at the first row and then at what’s missing from it. 268 breaches, carrying 4.87 billion records between them, leaked an email address with no password beside it.

For those, a new address buys you nothing. There was never a key to turn.

And the 518 that did leak a password? That’s where the real risk lives, and it’s a password problem, not an address problem.

In 2018, Virginia Tech researchers went through 28.8 million users’ leaked passwords across 107 services. 38% had used the same password on two different services, and 21% had changed it only slightly.

If the leaked password is one you also use on your email account, an attacker doesn’t need to hack in. They log in.

Google and UC Berkeley checked this at scale in 2017. They took 1.9 billion usernames and passwords from third-party breaches and found that 7% of the Google users in those files still had their current Google password sitting in the leak.

Only a slice. But a slice of a very large number is a lot of open doors, and Verizon’s 2026 breach report found credential abuse somewhere in the chain in 39% of the breaches it analysed.

The fix for that is a new password everywhere the old one was used. Takes an evening. A new email address takes months, and it leaves the reused password right where it was.

Old breaches don’t go away either

Most breaches are old by the time anyone hears about them. In our catalog, the median gap between a breach happening and the file reaching us is 1,560 days. Over four years.

And the median breach is now 82 months old by its breach date, nearly seven years. 529 of the 786 breaches are five years old or more, and 230 are ten years old or more.

So a new address doesn’t undo anything. The old address stays in every file it was ever in, and it still needs a strong password and alerts, because people will keep trying it.

And old passwords stay in use. When Google watched 21 million web logins in 2019, 1.5% of them used a password that was already sitting in a public breach, and that was the owners logging in, not attackers.

What you’d actually have after switching: two addresses to protect instead of one.

Case 1: You’ve lost the mailbox and can’t get it back

This is the big one, and it’s not the same as “my email was in a breach”.

A breach means your address and maybe a password sat in someone else’s leaked file. A takeover means someone used that (or a phishing page, or malware) to actually get into your mailbox.

Signs you’ve had the second one: a password that stopped working, a recovery phone or email you don’t recognise, forwarding rules you never set, “new sign-in” alerts from a city you’ve never been to.

Even then, don’t start with a new address. Start with getting the old one back.

Every major provider has a recovery flow. The FTC’s checklist for a hacked email account is the one I’d follow: run a malware scan, change the password, sign out of all devices, check that the recovery email and phone are yours, delete forwarding rules you didn’t set, then tell your contacts.

Do it from a device you trust.

And switch on two-step login before you do anything else. Microsoft’s 2025 Digital Defense Report puts it plainly: multi-factor authentication still blocks over 99% of unauthorised access attempts. I can’t think of a better reason to turn it on tonight.

When is it time to give up on the address? When the provider can’t restore it to you, or when someone else has held it long enough to reset your other accounts through it. At that point, the address is theirs in every way that matters, and you move.

How we help here: check the old address, then click any breach in the result. Its page tells you how that breach stored passwords (plaintext, easy to crack, hard to crack, or unknown), and plaintext or easy-to-crack is the one most likely to have been used against you.

Then set up free alerts on the new address on day one, so the next breach reaches you the day we add it, not months later from a news story.

Case 2: The address is on a domain you don’t control

Your old university address. The one from an employer you left in 2019. The ISP mailbox you had before you switched providers.

A breach notice is often how people discover one of these is still the login (or worse, the recovery address) at their bank, their pension, their phone carrier.

You can’t reset what you can’t receive. If a reset code goes to a mailbox you can no longer open, that account is one forgotten password away from being lost.

It happens with addresses you do control, too, if you stop using them. Google can delete a personal account that hasn’t been used for two years. Microsoft closes an Outlook.com inbox you haven’t signed into for a year.

The address you “keep for old sign-ups” can quietly stop existing.

So this case is less “change your email” and more “move everything off an address with an expiry date”. And you want to do it while you can still log into the old one.

The useful trick: the breach list for the old address is a ready-made inventory of where it’s registered. Run it on XposedOrNot, and most breaches in the result are a site you once signed up to with that address (skip the combolists and marketing lists; they tell you nothing about where you registered). Start your migration from that list.

A rarer cousin of this case: your provider can’t give you two-step login at all. Then the move is to a provider that can, and the rest of this section applies.

If you look after a company domain, the same thing happens at scale. Staff leave, their addresses stay registered on SaaS tools and vendor portals, and those addresses keep turning up in breaches. Free domain monitoring shows every address on your domain that appears in a new breach, including the people who left.

MSSPs looking after many client domains get the same picture across all of them through xonThreatIntel+.

Case 3: The address itself puts you at risk

Most of us use an address with our real name in it. That’s fine, until a breach puts that address next to a home address, a phone number, and a date of birth.

In our catalog, 220 breaches leaked home addresses, and 277 leaked phone numbers. My post on leaked phone numbers goes into what a stranger can do with that pair.

For most readers, that’s a scam-risk problem, and the fixes are the usual ones. For some readers it’s a safety problem: a stalker, an abusive ex, a harasser who now has a name-bearing address to search for.

This isn’t rare. Pew Research found in 2021 that 41% of US adults have been harassed online, and 11% have been stalked. About one in ten of the people harassed said the most recent incident happened in their personal email account.

The Safety Net project at the US National Network to End Domestic Violence puts it simply: you can get a new email account the abusive person doesn’t know about. And it says to consider keeping the old account for the evidence. (Refuge’s tech safety guide covers the UK side.)

If that’s you, a new address for the accounts that matter is the right call. Set it up on a device nobody else can see, keep the old one alive so you can see what arrives there, and don’t announce the switch.

There’s a quieter version of the same case. 41 breaches in our catalog are flagged as sensitive: dating sites, adult sites, a few forums you wouldn’t want on a CV. An address in one of those tells a story on its own, and a name-bearing address tells it with your name attached.

A new address doesn’t remove the old one from that file. What it does is stop your name travelling with every sign-up from here on.

Either way, do one more thing: switch on Privacy Shield for the old address. It hides that address from public breach searches on our side, so a casual lookup shows nothing, while you can still see your own results.

It doesn’t pull anything out of the breach files (nothing can), but it closes one easy window. It’s a one-way switch (lifting it is by request, not a button), so do it once you’re sure.

Three reasons that feel like a yes but aren’t

“My email is in 20 breaches.” Normal, honestly. Every one of the 786 breaches we index exposed email addresses, because an email is how you sign up for anything. My earlier post on why your email is in every breach explains the master-key problem.

The count isn’t the risk. The reused password is.

“The spam is unbearable.” Nearly 45% of all email sent worldwide in 2025 was spam, by Kaspersky’s count, so some of it isn’t even about you. A new address resets the flood for a year or two, then it leaks again, because you’ll sign up to things. A better fix is an alias per site (most providers do plus-addressing, and a few do real aliases), so the next leak burns one alias, not your inbox.

“My email was in a stealer log.” Then the thing to fix is the laptop. Malware on your machine copied what your browser had saved, and it’ll copy the new address tomorrow. Clean the device first.

The three kinds of leak are different enough that I wrote them up separately.

What to do instead, in order

1. Check the address on XposedOrNot and click through each breach. “Passwords” in its data-exposed list is the row that decides your evening.
2. Change the password on the breached site. If you’d used it anywhere else, change it there too, your email account first. And if anything about your machine feels off, run a malware scan before you type a single new password.
3. Turn on two-step login for the mailbox. An authenticator app or a passkey. Text codes if that’s all the provider offers, since something beats nothing.
4. Open the mailbox settings and look for forwarding rules, filters, recovery options, and connected apps you didn’t add. Attackers set these up to keep a way back in.
5. Set up breach alerts for the address, free, so the next one reaches you early.
6. Start using aliases for new sign-ups from here on. The address you give your bank shouldn’t be the one you give a pizza app.

Six steps and none of them is “get a new address”.

If you do switch: how to move without locking yourself out

If one of the three cases is yours, a few things make the move safer. Learned the hard way, some of them.

• Set up the new address with two-step login before it goes anywhere.
• Update recovery addresses first: your main email, your bank, your phone carrier, your password manager, government logins. Everything else can wait a week.
• Use the old address’s breach list as the inventory of sites to update, minus the combolists.
• Keep the old mailbox open for at least a year, with forwarding on, and keep it protected. Google says a removed Gmail address can’t be used by anyone in the future; not every provider promises that.
• Set up breach alerts on both addresses.
• In case 3, switch on Privacy Shield for the old address and don’t forward from it.

The caveats

• Our catalog holds the public breaches we’ve indexed, not every breach that ever happened.
• The data-class rows (“Passwords”, “Phone numbers”) are assigned per breach from what the files and the reporting show. Not every record in a breach carries every class.
• Breach age is measured from the breach date in our catalog to 1 October 2026. Where only a year was known, we used January of that year. The 1,560-day gap is the median from breach date to the date we added the breach.
• “Sensitive” is our flag for breaches where the site itself reveals something private. We don’t let anyone search those by email, and we never will.
• Records, not people.

FAQ

Should I change my email address after a data breach?

Usually not. Change the password on the breached site (and anywhere you reused it), switch on two-step login for your mailbox, and set up breach alerts. The only times I’d say yes: the mailbox is gone and the provider can’t give it back, the address lives on a domain you can’t log into anymore, or someone dangerous can find you through it.

Should I delete my old email account after switching?

No, keep it and protect it. Deleting it doesn’t remove it from any breach file, and not every provider promises a deleted address stays retired (Google does; others don’t say). Keep it alive with two-step login and forwarding for at least a year.

How do I know if my email account itself was hacked, not just leaked?

A leak means your address (and maybe a password) sat in someone else’s file; a takeover means someone got into the mailbox. Look for a password that stopped working, recovery details you don’t recognise, forwarding rules you didn’t set, and sign-in alerts from places you’ve never been. If you see those, recover the account first and read case 1 above.

Is it safe to keep an email that has been in many breaches?

Yes, as long as the password is unique, two-step login is on, and you get alerts for new breaches. Every breach we index exposes email addresses, so a long list is normal. The number of breaches matters far less than whether a password in one of them still works somewhere.

Appendix: Sources and references

• XposedOrNot catalog figures (786 breaches, 11,626,309,365 records; data-class counts; 268 breaches without passwords; breach ages; median breach-to-indexing gap 1,560 days): api.xposedornot.com/v1/breaches, pulled 1 October 2026. Anyone can pull the same fields (exposedData, breachedDate, passwordRisk, sensitive) from the open endpoint.
• 1.9 billion breached credentials, 7% match rate for Google users (12% keyloggers, 25% phishing): Thomas, Li, Zand, Barrett, Ranieri, Invernizzi, Markov, Comanescu, Eranti, Moscicki, Margolis, Paxson and Bursztein, “Data Breaches, Phishing, or Malware? Understanding the Risks of Stolen Credentials”, ACM CCS 2017, abstract and section 5.1.
• 1.5% of 21 million logins used a breached credential; 26% of warnings led to a reset: Thomas, Pullman, Yeo, Raghunathan, Kelley, Invernizzi, Benko, Pietraszek, Patel, Boneh and Bursztein, “Protecting accounts from credential stuffing with password breach alerting”, USENIX Security 2019, abstract and Table 3.
• 38% reused a password across two services, 21% modified one, 28.8 million users, 107 services: Wang, Jan, Hu, Bossart and Wang, “The Next Domino to Fall: Empirical Analysis of User Passwords across Online Services”, ACM CODASPY 2018, section 1.
• Earlier estimate: 43 to 51% of users reuse passwords across sites: Das, Bonneau, Caesar, Borisov and Wang, “The Tangled Web of Password Reuse”, NDSS 2014.
• Stolen credentials present at some point in 39% of breaches (13% as the first step, down from 22% in the 2025 edition after a method change): Verizon 2026 Data Breach Investigations Report, May 2026, pages 10 and 16.
• MFA “still blocks over 99% of unauthorized access attempts”: Microsoft Digital Defense Report 2025, November 2025, page 9; peer-reviewed basis: Meyer et al., “How effective is multifactor authentication at deterring cyberattacks?”, 2023 (99.22% risk reduction).
• 41% of US adults harassed online, 11% stalked, about one in ten cite their personal email account: Vogels, The State of Online Harassment, Pew Research Center, January 2021 (10,093 US adults surveyed September 2020).
• “You can get a new email account the abusive person doesn’t know about” and “Consider keeping the old account to keep the evidence”: Safety Net project, NNEDV, Email. UK equivalent: Refuge Tech Safety, Keep my emails private guide.
• Google inactive accounts deleted after two years (earliest December 2023): Inactive Google Account Policy; removed Gmail address “can’t be used by anyone in the future”: Remove Gmail from your Google Account.
• Microsoft account closed after two years without a sign-in (per the linked Microsoft account activity policy), Outlook.com inbox after one year: Microsoft Services Agreement, section 4.a.ii, effective 30 September 2026.
• Hacked-account recovery steps (scan, change password, sign out of all devices, check recovery details and forwarding rules, tell contacts): FTC, How To Recover Your Hacked Email or Social Media Account.
• 44.99% of all email sent worldwide in 2025 was spam: Kaspersky spam and phishing report for 2025, Securelist, February 2026.
• Related to this blog: your email is in every breach we index; how to check if your email was in a data breach; phone number leaked? Why it’s worse than a leaked email; breach dump, combolist, stealer log; Privacy Shield; 5 things in a data breach worse than a leaked password; how to avoid account takeover.

If this helped, a star on GitHub helps other people find the project. Honestly, it makes our day.

—