Finding your email address in a data breach does not prove your account was hacked. To know whether your email address has leaked, enter it on Have I Been Pwned: this free service lists the known breaches that contain it. As of October 28, 2026, its database holds 1,048 compromised sites and more than 17.8 billion addresses.
How do you check whether your email address has leaked?
Open haveibeenpwned.com, type your address in the search field and submit. The site answers with the list of breaches where it appears, or with a message saying no breach was found. Searches are not logged, according to the HIBP FAQ.
Test every address you use
The result only covers the address you enter. Test your main address, your work address if you used it for private sign-ups, and the old mailboxes (Gmail, Outlook, Yahoo) you still keep. CaptainVerify also offers an email address testing tool that lets you check whether an email has been compromised in a data breach.
Test your passwords
HIBP’s “Pwned Passwords” service compares a password with those already exposed in breaches. Passwords are hashed with SHA-1 and anonymized before they are sent. In this service, no password is stored next to personal data, according to HIBP.
What does the result mean: has your account been hacked?
Not necessarily. Appearing in a breach means that a service where you left this address lost data. Your mailbox can remain intact. Conversely, an empty result only guarantees that no breach known to HIBP contains the address. Everything depends on what was stolen and on whether you reuse passwords.
HIBP ranks breaches by level of certainty. An “unverified” breach is a leak whose legitimacy could not be established beyond reasonable doubt. A “spam list” gathers data used for targeted spam, without any system necessarily having been hacked. A “sensitive breach” cannot be found in the public search: only the verified owner of the address sees it, from their dashboard.
What data may have leaked along with your address?
It depends on the service that was hit: sometimes the address alone, sometimes much more. The leak at the French operator Free, which occurred in October 2024 and was added to HIBP on May 27, 2025, shows how far it can go. According to HIBP’s entry, it involved 14 million unique addresses, or 13.9 million accounts in the entry’s preview. Identity data (name, postal address, phone number, gender, date of birth) and, for many, an IBAN were linked to them.
So read the list of breaches with one question in mind: which service did I give which information to? A breach where you had left an IBAN calls for a faster reaction than a forum where you only gave a nickname.
Is an email address alone a risk?
Yes, a real one. An exposed address feeds targeted phishing and credential stuffing, which automatically tests stolen address and password pairs on other sites.
A fraudster who knows which service you are a customer of (an operator like Free, a bank, a retailer) can write a credible message, or even forge the sender (see email spoofing). A fake parcel tracking or refund link is enough to harvest your credentials: that is how phishing works. As for credential stuffing, it only succeeds if the same password is used elsewhere. With a unique password per service, a breach stays limited to that service.
What should you do if your address appears in a data breach?
Follow the order of the three-page leaflet published on October 1, 2026 by the French data protection authority, the CNIL, and Cybermalveillance.gouv.fr, “Violation de données personnelles, que faire en 3 étapes clés ?” (what to do in 3 key steps after a personal data breach): first the first week, then the following weeks, then everyday habits.
The first week
Keep the notification from the organization concerned, it will serve as proof. Then change the password, starting with your mailbox, because it can reset every other account. Choose a unique password that a password manager remembers, then turn on two-factor authentication or a passkey when the service offers one. Be wary of emails, texts and calls that mention the affected service.
The following weeks
Open your mailbox settings and check three things: active sessions, recovery addresses and the automatic forwarding rules. An attacker adds these rules to receive copies of your messages. Also change any password you reused elsewhere. In Gmail, according to Google, forwarding is set under Settings > See all settings > “Forwarding and POP/IMAP”. Connected devices can be checked in the security section of your Google Account. Cybermalveillance.gouv.fr, the French government’s cybersecurity assistance service, details this check for a hacked mailbox, with signing out of sessions and resetting reused passwords.
If the leak involved banking data, tell your bank. Then watch your statements and do not sign any suspicious SEPA mandate.
Day to day
Give services as little information as possible. Keep a work address and a personal address separate. Delete unused accounts: a database you have left can no longer leak your address.
Should you change your email address after a breach?
Rarely. Your address is already in the databases that leaked, and switching mailboxes would force you to update every account. Renewing the mailbox password and turning on two-factor authentication protects you more.
Changing makes sense if the mailbox becomes unusable under fraudulent messages. For the future, an email alias lets you isolate sign-ups. It is a forwarding address specific to each service: if one site’s alias leaks, you delete it without touching your main address.
Who should you notify and how do you report a breach?
The affected organization is responsible for informing you of a breach. The CNIL cannot tell you whether you are part of one. If you received no notification, write to the service concerned to get details. The CNIL also advises against unknown sites that claim to hold the data and to tell you whether you are affected. Have I Been Pwned, run by Troy Hunt since 2013, only reports the breaches it has indexed.
The GDPR (the European regulation of 2016) gives you a right to erasure: you can ask a service to delete your account and the associated data. In case of proven harm, such as a fraudulent debit or identity theft, the complaint is filed online on “THESEE”. Cybermalveillance.gouv.fr cites this French Ministry of the Interior service.
A disclosed address stays disclosed: what you can change is the lock behind it. Reopen the entry for each breach listed by Have I Been Pwned and deal first with those that touch your mailbox or your banking data.
