Found Your Email on Have I Been Pwned? Do These 6 Things Next

Found your email on Have I Been Pwned? It means a service you signed up for was breached and your email was in the leaked data. Your inbox itself probably wasn't hacked. Check which data leaked, then work through six steps: passwords, reuse, two-step sign-in, phishing watch, credit freeze and alerts.

By Gary, Greenlight My App · Updated Oct 30, 2026 · How we checked this: Tested on Oct 30, 2026, 7:00–7:09 AM ET. We ran a free Have I Been Pwned search on our company contact address, opened Google's Password Checkup page (without signing in), and ran a Greenlight My App scan on a demo app before and after fixing an exposed table. We also re-read the HIBP FAQ, Mozilla Monitor and the CFPB's credit freeze guidance. Drafted with AI tools and reviewed by a person before publishing.

Seeing your email on a breach list is unsettling. The good news: most of what you need to do takes under an hour, and the order matters more than the speed.

What does it mean if Have I Been Pwned finds my email?

Have I Been Pwned (HIBP) collects data from public breaches and lets you search it. A hit means your email address appeared in at least one of those breach datasets.

It does not mean:

• someone logged into your email account;
• your current password is known (HIBP doesn't store passwords next to email addresses, per its FAQ (external));
• you did anything wrong.

It does mean the data listed under that breach, such as passwords, phone numbers or addresses, may be in criminals' hands.

Why am I in a breach for a site I never used?

HIBP's FAQ gives a few common reasons: the service was bought by or renamed from one you did use, your data was shared or sold to it, or someone else signed up with your email. Some listings come from spam lists or "stealer logs" rather than a single company breach.

What should I do first? Read what leaked

Each breach on HIBP lists the data that was exposed. That list tells you how worried to be.

Worked example: say HIBP shows two breaches. One, from 2019, leaked "email addresses, passwords". The other, from 2024, leaked "email addresses, names, phone numbers". The 2019 password leak is the urgent one if you ever reused that password. The 2024 one means you should expect more convincing scam texts. Do the password steps first.

What does a clean result look like?

We searched our company's public contact address on Oct 30, 2026. HIBP returned 0 data breaches with the message "Good news — no pwnage found!". A clean result like this is good news, but as the FAQ notes, it isn't a guarantee (more below).

The 6 things to do next

Work through these in order.

1. Change the breached password

Go to the breached service, if it still exists, and change your password. If you can't remember the account, use its "forgot password" flow. If the service is gone, skip to step 2. That's the step that matters most anyway.

2. Change it everywhere you reused it

This is where most of the harm happens. Attackers take leaked email and password pairs and try them on email, banking and shopping sites. It's called credential stuffing.

Make a list of every account that used the same or a similar password. Start with your email account, because it can reset everything else. Then banking, shopping and social accounts.

A password manager makes this realistic. It creates a different, random password for each site and remembers them for you. Google's Password Checkup (external) can also flag saved passwords that appeared in known breaches.

3. Turn on two-step sign-in

Two-step sign-in (also called two-factor authentication or MFA) means a stolen password alone isn't enough. Turn it on for email first, then money accounts.

4. Watch for phishing that uses the breach

After a breach, scammers send emails that mention the breach, offer a "refund" or "compensation", or ask you to "verify" your account. Don't click links in those messages. Go to the company's site by typing its address yourself.

HIBP's own notifications come from noreply@haveibeenpwned.com, per its FAQ. Anything else claiming to be HIBP deserves suspicion. If a message sends you to a site you aren't sure about, run through our 9 checks to tell if a website is legit.

5. Freeze your credit if ID numbers leaked (US)

If a breach exposed a Social Security number or similar ID, place a credit freeze. A freeze stops new lenders from pulling your credit report, which blocks most new-account fraud. It's free, and you place it with each of the three bureaus: Equifax, Experian and TransUnion. The CFPB (external) explains how freezes work and how to lift one when you apply for credit.

Outside the US, check your national consumer protection or data protection authority for the local equivalent.

6. Set up alerts for the next breach

You can sign up on HIBP to get an email if your address shows up in a future breach. Mozilla Monitor (external) offers a free breach scan as well. Alerts mean you hear about the next one early instead of by accident.

What if Have I Been Pwned says I'm not pwned?

Good news, but not a guarantee. HIBP's FAQ is clear that "not found" doesn't mean you've never been compromised. Some breaches are never made public, and some are kept as "sensitive" breaches that are visible just to the verified owner of the address through the HIBP dashboard. Keep doing the basics: different passwords, a password manager and two-step sign-in.

Is Have I Been Pwned safe to use?

Its FAQ says searches aren't logged. Its Pwned Passwords feature checks passwords using hashed, anonymised lookups, so you aren't sending your actual password. Even so, you don't need to type your current password into any site to check a breach. Searching your email is enough.

How do other breach checkers compare?

For builders: is your app the next breach?

If you run an app, the same story runs in reverse: a leak in your product puts your users on HIBP. Common causes in small apps include API keys shipped in frontend code, databases with row-level security turned off, and secrets committed to git.

Good starting points:

• What is an API key? and how to keep one server-side.
• Is my API key stolen? for signs and a cleanup checklist.
• Postgres row-level security for apps on Supabase or Postgres.

Tested: an exposed table, before and after

To show what this looks like, we ran a Greenlight My App scan on a demo app on Oct 30, 2026. Be clear about the setup: this was not hosted Supabase. We applied the demo's Supabase migrations to a local PostgreSQL 17.6 database behind PostgREST 12.2.3, with Supabase-style anonymous and signed-in roles and three fake rows.

• Before: the scan returned FAIL, "A Supabase table returned rows to your public key". A policy let anyone read every profile.
• Fix: we dropped that policy and added one that lets signed-in users read their own profile.
• After: the scan returned PASS, "None of the 1 tables we checked returned rows to the public key". An anonymous request that returned 3 rows before now returned none.

Run a free Greenlight scan to check your live site for exposed keys, open tables and missing security headers.

FAQ

Does Have I Been Pwned mean my email was hacked? Usually not. It means your email address was in data leaked from a service you used, or from a list that includes your address. Your inbox could still be at risk if you reused the leaked password there, so change it and turn on two-step sign-in.

How do I know which password was leaked? HIBP doesn't show your password. It tells you which service was breached and when. Change the password you used on that service, plus any account that shares it. If you can't remember, assume it was a password you reused and change your important accounts.

Should I delete my account on the breached site? If you no longer use it, deleting the account reduces what can leak next time. Change the password first, so the old one isn't valid, then delete. Some services keep data after deletion, so read their privacy policy if this matters to you.

Is a credit freeze free? In the US, yes. Placing and lifting a freeze is free at Equifax, Experian and TransUnion, and you need to contact each bureau separately. The CFPB has a plain-English guide to how freezes work.

---

Building an app? Run a free Greenlight scan (external) to catch exposed API keys and missing security headers before your users end up on the next breach list.