Has Your Email Been in a Data Breach? Free Ways to Check and What to Do Next

The fastest free check is Have I Been Pwned (haveibeenpwned.com). Type in your email address and it lists the known breaches that included it, usually with the date and the types of data taken. If your address shows up, change the password on that account and anywhere you reused it, turn on two-step verification, and freeze your credit if a Social Security number was exposed. You don't need to pay for a scan to do any of this.

For related comparisons and help, see Plex hack and Cloudflare WARP vs. a VPN.

Google told users that its free Dark Web Report would stop scanning on January 15, 2026, and that access to reports would end on February 16, 2026. Google points people to Security Checkup and Password Checkup for account-security reviews.

Free ways to check your email (October 2026)

Tool	What it checks	Cost
Have I Been Pwned	Whether your email address appears in known public breaches; optional free alerts for future breaches	Free for individuals
Google Password Checkup	Passwords saved in Google Password Manager that appeared in known leaks	Free with a Google account
Apple Passwords security recommendations	Saved passwords on iPhone, iPad and Mac that appeared in known leaks	Free on Apple devices
Your password manager's breach alerts	Saved logins tied to known breaches	Often included with the manager you already use
Breach notice letters or emails	Companies that lost your data are often required to notify you	Free

Tool details checked October 26, 2026. Google's dark web report shutdown dates are from Google's notice to users.

Be careful with any "check your email" link that arrives by text or email. Go straight to the tool's website instead, because scammers copy breach-check pages to harvest passwords. A legitimate checker never asks for your email password.

What to do if your email was in a breach

1. Change the password on the breached account. Use a long, unique password.
2. Change it everywhere you reused it. Criminals test leaked email and password pairs on banks, shopping sites and email accounts.
3. Turn on two-step verification or a passkey for your email account first, since email resets almost every other account.
4. Check your email settings for forwarding rules, recovery addresses or phone numbers you didn't add.
5. Close accounts you no longer use. Old shopping and forum accounts are often where breaches start.
6. Freeze your credit at Equifax, Experian and TransUnion if a Social Security number was exposed. Freezes are free.
7. Watch for follow-up scams. Leaked names, numbers and addresses make phishing and phone scams more convincing.

If you use an internet provider's email address

Many people still use an address from their internet provider, such as a Spectrum, Xfinity or Comcast, AT&T (often run through Yahoo), or Verizon (now on AOL) account. Those addresses show up in breaches like any other, and they add a risk of their own: if you cancel or switch providers, you can lose the mailbox or its recovery options.

• Secure it the same way. Change the password and turn on two-step verification in the provider's account settings.
• Know the rules before you switch. Some providers let you keep email after you cancel, sometimes for a fee. See how to keep your ISP email after switching.
• Hughesnet users need to move now. Hughesnet is retiring its email service on November 16, 2026. Read what the Hughesnet email shutdown means.
• Frontier customers affected by its 2024 breach can read about the Frontier data breach settlement.

If you move to a new address, update your bank, medical, utility and government accounts first, then set up forwarding from the old mailbox while it still works.

Leaked details and "loved one in trouble" calls

A breach can give scammers your name, phone number, relatives' names and even voice clips posted online. With that, they can fake a call from a family member who says they're in trouble and need money fast, sometimes using an AI-cloned voice. Hang up and call the person back on a number you already have. Agree on a family code word, and never pay by gift card, wire or crypto because a caller is rushing you. More tips are in how to fight scam phone calls.

Frequently asked questions

Is Have I Been Pwned safe to use?

Yes. It's a long-running free service. It only asks for your email address, never your password.

Does Google still have a dark web report?

No. Google discontinued it in early 2026 and recommends Security Checkup and Password Checkup instead.

Should I delete an email address that was in a breach?

Usually not. Securing it with a new password and two-step verification is enough. Consider moving to a new address only if it gets constant spam or phishing.

Do I need a paid identity-monitoring service?

Not to check or respond to a breach. The free tools and steps above cover the essentials, and credit freezes are free.