How to Check For Data Breach and What to Do Next
Data breaches are now a routine part of online life. Companies you have never thought about may hold your email address, your password or more, and any of them can be hacked.
You cannot undo a breach, but you can limit the damage. This guide shows how to check if your data was breached, and what to do next based on what was exposed.
1. Check Your Email Address
The quickest check is Have I Been Pwned, a free service where you enter your email address. It tells you whether the address appears in the breaches the service has loaded, and which ones. It can also notify you when your email shows up in future breaches.
The site separates two kinds of results. A breach is an incident where data was unintentionally exposed to the public. A paste is information published on a public text-sharing site, which is often an early sign of a breach.
A clean result is good news, but it is not a guarantee. The service only reports on breaches it knows about.
2. Read the Company’s Notice
If a company tells you your data was exposed, read the notice carefully. The US Federal Trade Commission (FTC) advises that if the company responsible offers free credit monitoring, you should take advantage of it.
The notice should say what type of information was involved. That detail decides your next steps.
3. Match Your Response to What Was Exposed
The FTC’s data breach guide sorts the advice by the type of information exposed.
An online login or password. Log in to that account and change your password, and your username if you can. If you cannot log in, contact the company and ask how to recover or shut down the account. However,If you used the same password anywhere else, change it there too. If it is a financial site, or a card number is stored, check the account for charges you do not recognize.
Bank account or card details. If bank information was exposed, contact your bank to close the account and open a new one. If card details were exposed, contact the bank or card company to cancel the card and request a new one.
A government ID number. The FTC’s advice for exposed Social Security numbers is to get your free credit reports and check for accounts or charges you do not recognize. It also suggests considering a credit freeze, or at least a fraud alert, and filing your taxes early.
A child’s information. The FTC points to a separate guide on child identity theft.
Your response should match what was exposed. A leaked password needs a new password, while leaked card details need a new card.
The FTC guide is aimed at US readers, and it is dated 2016. Credit freezes and annualcreditreport.com are US services. If you live elsewhere, contact your bank and ask your country’s data protection regulator what protections apply. That part is our own advice.
4. Use Strong, Unique Passwords
This step is our own advice. Reusing passwords turns one breach into many. A password manager can create and store a different password for every account, and turning on two-step verification adds a second barrier if a password leaks.
For more on securing accounts, read our guides on securing your AI accounts and protecting your digital privacy in 2026.
5. Watch for Follow-Up Scams
Also our own advice: criminals often use breach details to make scam messages look real. Be wary of any email or text that mentions a recent breach and asks you to click a link or share a code. Go to the company’s official website or app yourself instead.
6. Keep Watching
Check your bank and card statements regularly for transactions you do not recognize. Keep a secure record of your card issuers’ phone numbers so you can call quickly if something looks wrong. Sign up for breach notifications so you hear about new exposures early.
To see how common serious breaches have become this year, read our roundup of the worst cyberattacks and data breaches of 2026 and our report on the IDScan driver’s licence breach.
