How to Check If Your Email Was in a Data Breach (and What Actually to Do)

Odds are your email is sitting in a breach right now. Nobody told you.

Not because they did anything careless. Because companies they trusted got breached, and the typical gap between a breach happening and surfacing publicly runs to years. The data leaks quietly; the notification, if it ever comes, comes late.

Finding out takes about a minute and costs nothing. Knowing what to do about what you find takes this post. I run XposedOrNot, a free, open-source breach search engine indexing 775 breaches and 11.58 billion leaked records, so I will show you with the tool I built; the advice holds regardless of what you use.

Step 1: Check your email (10 seconds)

Go to xposedornot.com, type your email address, and search. No signup, no credit card. Your search is processed in memory and never logged in any identifiable form; that promise is written into the privacy policy, not just this post.

You get back every known breach your address appears in, listed by name and year, newest first. Click any of them and the breach’s full card opens: what happened, when, and, most importantly, what leaked in it: passwords, phone numbers, addresses, dates of birth, and so on. That last part is the one to actually read, because the rest of this guide keys off it.

Two outcomes:

• Nothing found. Genuinely good news, with one caveat: it means nothing indexed was found. Breaches surface late (more on that below), so set up the free alert (Step 5) and enjoy the clean result honestly.
• Results found. Do not panic. With 11.58 billion records out there, appearing in old breaches is closer to normal than exceptional. What matters is the next four steps.

Step 2: Check every email you use (2 minutes)

Work address, personal address, the ancient one you keep only for logins. Attackers do not treat them separately; they link everything. The old Hotmail you abandoned in 2015 can still be the recovery address on your current bank account. Run each one through the same search.

And think past yourself for a second. Most families have exactly one person who reads posts like this, and that person quietly ends up responsible for everyone’s accounts. If that is you, My Circle lets you monitor family members’ exposure with their explicit consent; each person approves from their own inbox before you see anything. Checking your parents’ emails the consent-free way, by just typing them in, shows you public results only, and honestly, for a first look, that is fine too.

Step 3: Read what actually leaked, and triage (5 minutes)

Everyone skips this step. It happens to be the one that turns a scary check into a useful one, because exposure comes in grades. Sort your results:

Urgent: passwords. Any breach listing “Passwords” in the exposed data. Even hashed passwords should be treated as compromised over time; in our analysis of 513 password-exposing breaches, 57% stored passwords recoverably, plaintext or trivially crackable, and that figure is the floor.

Urgent, special case: a “Stealer Logs” tag. No website got hacked for this one. Malware on an infected device harvested what its browser held, and your credentials were in the haul. The response has its own order: devices scanned first, sessions signed out everywhere second, passwords rotated last, from a machine you trust.

Important: identity data. Dates of birth, government IDs, physical addresses, phone numbers. You cannot rotate your date of birth. Exposure here means: be extra skeptical of personalized phishing (they know things about you), consider credit monitoring where relevant, and know that “verification questions” about you are answerable by strangers.

Annoying: everything else. Email on a marketing list, usernames, that sort of thing. Expect more spam; no emergency.

A worked example, because triage is easier to copy than to invent. Say your results show three hits: a 2012 professional network that leaked passwords, a marketing platform that leaked only your email, and one entry tagged Stealer Logs. The marketing hit changes nothing. The 2012 one matters exactly as far as you reused that old password, so it sends you to Step 4 with a short list. The stealer tag jumps the queue entirely: device scan first, tonight, before any password gets changed on a machine you have not cleared. Three hits, three completely different responses. That is triage.

Step 4: Fix the passwords, in the right order (30 minutes, maybe)

For every breach that leaked a password:

1. Change the password on the breached service. Still use it? Fine. If not, deleting the account beats leaving it around.
2. Change it everywhere else you reused that password. This is the part that matters most and gets skipped most. A leak from a forum you forgot becomes a bank problem only through reuse. This attack, credential stuffing, is automated and industrial; here is how it works if you want the mechanics.
3. Start with email and banking, because email resets everything else.
4. Let a password manager generate replacements. Unique-everywhere as a default beats discipline every time. Any reputable manager beats none.

You are already in the security settings, so flip on two-factor authentication while you are there. Email and banking first, then anything that touches money or identity. It will not stop everything (stolen session cookies walk right past it), but the most common attack is still someone typing your leaked password into a login box, and 2FA ends that one.

Wondering about a specific password? The password checker tells you whether it appears among 835 million+ exposed ones. It uses k-anonymity: only a partial one-way hash ever leaves your browser, so we never see the password itself.

Step 5: Turn on alerts, so you never do this manually again (1 minute)

You will appear in future breaches; everyone does. The difference worth engineering is when you find out. Breaches routinely take years to surface publicly, and your window to act starts when they surface, not when they happened. Our July roundup had one entry arrive eight and a half years late.

Subscribe your email at xposedornot.com: takes a minute, free, and you get notified when your address shows up in anything newly indexed. Check once, monitor forever.

Beyond the list: your dashboard

The search gives you a list. If you sign in (passwordless, a magic link to your address), My Dashboard turns that list into a picture: a risk score with the reasoning spelled out underneath, your exposure plotted on a timeline so you can see whether it is historical or ongoing, a breakdown of how well each breach stored its passwords, and a short “What to do next” list that stays synced to your actual results.

None of it is required; the five steps above work from the plain search. But if you are the kind of person who wants to see the whole battlefield once instead of checking pieces forever, that is the view.

Optional extras, depending on who you are

• You would rather strangers could not look you up: Privacy Shield hides your email from public searches while keeping your own results visible to you. Free.
• You manage a company domain: you can get this entire picture, org-wide, with free domain monitoring. Ten-minute setup.
• You are a developer: everything above is available through a free, keyless API, including the k-anonymity password check.

The honest FAQ

Is it safe to type my email into a breach checker? Fair paranoia; reward it. Prefer checkers that do not require signup, state what they store, and ideally publish their code. Ours processes searches in memory, never logs them in identifiable form, and the entire platform is open source; read it yourself.

The site says I am in a breach I never heard of. How? Companies disclose late, sometimes never; data circulates privately for years before surfacing. Also, some entries are compilations (combolists) recycling many old leaks into one file; here is how to read the different types.

Why do different breach checkers show different results? Different services index different breaches, verify them differently, and count differently (records versus unique emails, for one). Disagreement between checkers is normal and does not mean either is lying. The useful question is whether a checker shows you what leaked and where its numbers come from. Ours you can audit: every entry in the index is publicly queryable.

Can I check someone else’s email? The public search works for any address, deliberately: attackers already have this data, and pretending otherwise protects no one. What you cannot do is subscribe someone else to alerts or see a stranger’s organized dashboard; both require verifying you control the address. And if being publicly searchable bothers you, Privacy Shield removes your address from public results.

I checked and I am in nothing. Am I safe? You are un-indexed, which is good and different. Keep the alert on; the gap between breach and surfacing is the whole reason monitoring exists.

Should I change all my passwords right now? No. Change the leaked ones and their reuses, in the order above. “Rotate everything” burns your energy on the wrong problem and usually does not survive contact with Tuesday.

What about my phone number or address being out there? You cannot rotate those, which is exactly why the triage step treats identity data differently from passwords. Watch for phishing that uses the leaked details to sound legitimate, be stingy with “security questions” whose answers already leaked, and where finances are involved, consider a credit freeze; it is free and reversible in most places.

How often should I re-check manually? Ideally never; that is the entire point of Step 5. The alert re-checks for you every time something new is indexed. The two moments a manual search earns its keep: when you create a new address, and when a breach headline names a service you use. For the second, you can also look the breach up by name instead of searching your email at all.

My data is out there and I cannot un-leak it. What is the point? Control the half you control: unique passwords, 2FA, alerts, and skepticism toward anyone who contacts you knowing things they should not. Leaked data ages poorly when it stops being reusable.

The one-minute version

1. Check every email you use: xposedornot.com
2. Triage by what leaked, not how scary it sounds
3. Fix leaked passwords and their reuses, email and banking first
4. Turn on 2FA where it counts
5. Set the free alert and stop checking manually

That is the whole routine. The check takes ten seconds. Worst case? You learn something useful.

If this guide helped, drop us a star on GitHub. It helps others find a free tool in a paid market, and honestly, it makes our day.

Appendix: Sources and references

• Breach and record counts: 775 breaches / 11.58B records, live at xposedornot.com/xposed, re-pulled 2026-08-10, refresh at publish
• Password storage analysis (57% of 513 password-exposing breaches): reproducible via api.xposedornot.com/v1/breaches (full write-up ships as its own post)
• Search privacy (“processed in memory, never logged in any identifiable form”): privacy policy
• 835 million+ exposed passwords, k-anonymity checking: xposedornot.com/password
• Leak types and the stealer-log playbook: breach dump vs combolist vs stealer log
• Credential stuffing mechanics: OWASP