How to Check if Your Personal Information Was Exposed in a Data Breach

Your personal information could be circulating online without your knowledge… even if you've never received a data breach notification.

Recent breaches involving retailers and identity-verification companies have highlighted a troubling reality: Personal information can be exposed long before the people affected learn about it. Some exposure can be checked in minutes, although no single tool can uncover every leak.

The important distinction is knowing where to look, what a positive result actually means, and what to do before stolen information is used against you.

How to check if your information was exposed

One of the easiest starting points is Have I Been Pwned, a free service that lets people check whether their email addresses appear in its database of known data breaches.

Sensitive breaches are excluded from public search results to protect the privacy of affected individuals. To view sensitive breach results, users must verify ownership of the email address they're checking.

The service aggregates breach data and makes it searchable without displaying exposed passwords alongside individual email addresses. It also includes some datasets labeled unverified or fabricated. These may contain genuine email addresses even when the alleged breach cannot be confirmed, or the data did not originate from the company named in the listing.

To check your email address:

1. Visit Have I Been Pwned and enter your email address.
2. Review any matching breaches and the types of information reportedly exposed.
3. Repeat the search for other email addresses you've used, including older addresses associated with shopping, social media, or financial accounts.
4. Check whether you still use the affected services, especially if you reused passwords.
5. Sign up for breach notifications and verify your email address to receive future alerts. To check sensitive breach records, verify ownership of your email address and open the Breaches section under Personal in your Have I Been Pwned dashboard.

You can search older email addresses even if you no longer have access to them. However, initial ownership verification and breach notifications require access to the specific email inbox being checked. Users who have already registered a passkey may also be able to access their dashboard without a new email verification link.

A match means your email address appears in a dataset indexed by Have I Been Pwned. However, not every listing represents a confirmed breach of the named company. A match also does not necessarily mean that your email account was hacked, that someone accessed your other accounts, or that your password was stolen.

Even after you secure an affected account, its historical breach record may remain visible. Equally important, a clean result does not guarantee your information is safe. The service only covers data it knows about, and some compromised information never becomes publicly searchable.

Google's Password Manager and Apple's built-in password security recommendations can also help identify saved passwords that have appeared in known leaks or need attention.

You can also use Have I Been Pwned's Pwned Passwords tool to check whether a password has appeared in known breaches. The service checks passwords separately from email addresses and does not reveal which account used a particular password. If a password appears in the database, stop using it and replace it with a strong, unique password on every account where it is currently used.

For passwords you currently use, a trusted password manager's built-in security checker is another option. Avoid entering passwords into unfamiliar breach-checking websites.

These checks are particularly useful following incidents involving customer accounts. For example, eSecurity Planet examined how an ASOS account takeover incident affected 138,828 customers, illustrating why account security deserves attention even when users haven't noticed suspicious activity.

What to do if your personal information was leaked

The next step depends on the information exposed. An exposed email address presents different risks from a stolen password, Social Security number, or driver's license.

For password-related incidents, the Cybersecurity and Infrastructure Security Agency recommends using strong, unique passwords, ideally managed through a password manager.

Multifactor authentication provides another important safeguard. However, authentication methods differ in effectiveness, and phishing-resistant options such as passkeys or security keys generally provide stronger protection against credential theft.

The risks can be more complicated when government identification documents are involved. eSecurity Planet also reported that a September 2026 Texas breach filing listed 13 million people affected by the IDScan incident, highlighting the lasting risks associated with exposed government-issued identification information.

For Social Security numbers and other sensitive identity data, consumers can visit IdentityTheft.gov for recovery guidance.

Consumers can also freeze their credit for free through Equifax, Experian, and TransUnion. A credit freeze restricts access to credit reports, making it harder for identity thieves to open new credit accounts. You must contact each bureau separately, and the freeze remains in place until you lift it.

As eSecurity Planet explained in its coverage of the National Public Data breach, exposure involving sensitive personal identifiers may require additional precautions beyond changing passwords.

How to confirm whether a breach notification is legitimate

Not every message claiming your information was stolen comes from the company involved. Cybercriminals can use breach headlines to send convincing phishing emails that pressure recipients into clicking malicious links or revealing passwords.

If you receive a breach notification, visit the company's official website directly rather than following an unexpected link. Look for a published security notice, confirm which information was affected, and contact the company through an established support channel if necessary.

The Federal Trade Commission advises consumers to avoid unexpected links and contact organizations using websites or phone numbers they already know are legitimate.

You should also review your credit reports through AnnualCreditReport.com, the federally authorized source for free credit reports. Unfamiliar accounts or unexplained changes may indicate that your information has already been misused.

Why checking once isn't enough

A breach lookup is a useful starting point, but it cannot provide a complete picture of where your information has traveled.

According to Have I Been Pwned's documentation, the service aggregates known breach records, including some whose legitimacy has not been fully established, and does not expose passwords alongside the email addresses it indexes. That means it can help identify potential exposures without revealing everything an attacker may have obtained.

Credit freezes have limitations, too. They restrict access to your credit reports and make it harder for criminals to open new accounts in your name, but they do not prevent fraudulent charges on existing accounts. That's why reviewing bank and credit card statements remains important.

If you discover unfamiliar accounts, fraudulent charges, or other signs of identity theft, contact the affected financial institution immediately. You can also report identity theft through IdentityTheft.gov, which provides a personalized recovery plan. The FTC recommends reviewing financial statements and credit reports regularly to identify suspicious activity.

The most effective approach combines regular breach checks, unique passwords, multifactor authentication, and attention to suspicious account activity. You may not be able to prevent every company from losing your information, but you can make it substantially harder for criminals to turn that exposure into account theft or financial fraud.

More cybersecurity news: For a closer look at recent incidents, explore eight major data breaches of 2026 and learn what personal information was exposed and how affected individuals can protect themselves.