Many people are shocked to learn their email address has been in a data breach, often more than once. Checking takes three minutes, costs nothing and tells you where to act first.
The check
Type haveibeenpwned.com into your browser yourself (do not click a link from an email) and enter your email address. The site, run by security researcher Troy Hunt, lists known breaches that included that address. It never shows your passwords, and you should never type a password into it.
What to do with the result
- Change the password on any breached site. Do it now, not later.
- Change it everywhere you reused it. This is the step people skip, and it matters most.
- Switch on two-step verification for your email first, then banking and social accounts.
- Use a password manager so every account gets a different password you do not have to remember.
Keep the protection running
You can subscribe to breach alerts so you hear when your address appears in a new one. For anything important, prefer app-based codes or security keys over text messages, and treat any email that says "your account was hacked, click here" as suspicious until you verify it directly on the official website.
Cyber Security: Understand how attacks work so you can stop them.
See the course