Almost every week brings news of a data breach: an airline, a university, a web host or a retail chain. Most people read and move on, assuming it does not concern them. But the chance that your email address, and sometimes an old password, has already appeared in some breach is very high. The good news is that it is easy and free to check.
The best-known tool is Have I Been Pwned, a site created by security researcher Troy Hunt. Type in an email address and you get a list of known breaches it appeared in, and what kind of data was exposed in each: name, phone, address, date of birth or password. You can also sign up for alerts, so you get an email if the address appears in a new breach. Google and Apple offer similar checks: their password managers warn if a saved password has appeared in a breach.
Found yourself on the list? Do not panic, but act. If a password was exposed, change it immediately on the breached site and on any other site where you used it. That is the most important step, since attackers automatically try leaked passwords on other sites. Turn on two-step verification on important accounts. And if details such as phone, address or date of birth were exposed, be especially alert to messages that use them to look convincing.
Remember that a breach does not always mean someone got into your account. Sometimes only the email was exposed, which mainly means more spam and phishing. But data from different breaches accumulates, and scammers combine it into a full profile enabling targeted scams, such as a message 'from the airline' with your real flight details, or a call 'from the bank' that knows your birthday.
For anyone who wants to deal with it in one hour: check your main email on Have I Been Pwned, run Google's or Apple's password check, change every password flagged as compromised or reused, and move to a password manager and passkeys on important accounts. It will not stop the next breach, but it will make sure it does not open every door at once.
