The short version: a data breach is when someone who should not see a company’s records sees or copies them. You can check for free, and most steps are small. Change the password if one leaked. Then watch for scam messages that use the news to trick you.
What a data breach is
A company keeps records about you, like a filing cabinet. It may hold your name, email, phone number, or password. A data breach happens when someone who should not have access opens that cabinet. It can happen by hacking (someone breaking into a computer system), by mistake, or when a device is lost.
Being in a breach does not mean someone hacked you. It means a company you used lost control of some of your details. Breaches are common, and you can take calm steps.
Why it matters
Criminals use leaked details to make scam messages look real. A fake message that knows your name and address can feel personal. In fact, criminals often send the same message to millions of people. Also, many people reuse one password on several sites. A leaked password may then open other accounts.
How to check
You have three simple ways. None needs a password.
- Read the notice. If a company wrote to you, it should say what was exposed. If you doubt the message, go to the company’s own website yourself. Do not use the links or phone numbers in the message.
- Use a free breach-check site. Have I Been Pwned is one well-known example. You type in an email address. It lists the known breaches that include that address. Some breaches are marked “sensitive”. The site shows those only after you confirm that you own the address, by email.
- Look at the tools you already use. Some password managers and antivirus tools (programs that look for harmful software) include a similar check. See our guide to password managers.
A result of “not found” is good news, but it is not proof. The site says it holds only a small part of all breaches. Many breaches never become public.
Never type a password into a breach-check site. An email address is all you need. Have I Been Pwned also has a separate password page. You do not need it for this guide.
What to do, by what leaked
Email and password. Change the password on that site. Change it on any other account that uses the same one. A password manager can make a new, different password for each site. Then turn on extra sign-in protection. An authenticator app is a good choice. See our guide to two-factor authentication.
Phone number. Expect more scam texts and calls for a while. Do not click links in texts you did not expect. If a call asks for a password or code, hang up.
Card or bank details. Call your bank or card company. Use the number on the back of your card or on your bank statement. Do not use a number from a message. Ask them to cancel the card and send a new one if your card number leaked. Look at your recent charges. If you lost money, tell your bank first. UK: if your bank supports it, you can also call 159 to reach it safely.
ID numbers, like a Social Security number.
- US: a credit freeze stops anyone from opening a new credit account in your name. It is free to place (turn on) and lift (turn off). It does not affect your credit score. Lift it for a short time when you apply for credit. You ask all three credit bureaus (companies that keep credit records): Equifax, Experian, and TransUnion.
- UK: you can ask for your credit report from the credit reference agencies. These are the companies that keep credit records. It is free by law, and checking it does not affect your score. Look for accounts you do not recognise.
Health details.
- US: Read the statements from your health insurer. A statement called an Explanation of Benefits lists the care your insurer paid for. Look for care or medicine you did not get. If something is wrong, call your doctor’s office and your insurer.
- UK: The health service that had the breach should tell you what was exposed. You can ask it what happened and what it will do. Watch for scam calls, texts, emails, or letters.
Some companies offer free credit monitoring after a breach. Credit monitoring means a service tells you when something new appears on your credit report. In the US, the FTC says to accept it if you are offered it. Every step above is free to do yourself. You do not need a paid service to take them.
The next scam
After a breach, fake “breach help” messages often follow. They may be emails, texts, or calls. They may say your account is at risk, offer compensation, or ask you to “verify” your login. Some claim to come from the company that had the breach. Scammers may use the news even if your details were not in it.
- Do not click the link. Go to the company’s website yourself.
- A real company does not need your password or a code from you to explain a breach.
- Pressure to act fast is a warning sign. Slow down.
Where to report or get help
US: go to IdentityTheft.gov. It lists steps for each kind of leaked detail. If someone has used your details, you can report it there and get a personal recovery plan. Report scam messages to the FTC at ReportFraud.ftc.gov.
UK: report fraud and cyber crime to Report Fraud, the service that replaced Action Fraud. In Scotland, call 101. Forward scam emails to report@phishing.gov.uk. Forward scam texts to 7726.
Do this today (about 6 minutes)
- Open haveibeenpwned.com. Type in your main email address. Do not type a password.
- If the address appears, change the password for that account.
Never type a password into a breach-check site, and never read a code out to someone who contacts you.
Another day: If you used the same password on other accounts, change it on each one. Also turn on extra sign-in protection for your email if it is not on yet. (See our guide to two-factor authentication.)
Checked: 27 Oct 2026. The steps are for haveibeenpwned.com, US credit freezes, and UK credit reports. Websites change. If a page looks different, search the organization’s help page.
Our disclosure. SafeinAI has no affiliate links and earns nothing from the sites or tools named on this page. If this ever changes we will say so here, on this page.
Leave a Reply