How to Check If Your Data Was Leaked — and Exactly What to Do Next

Last Updated on June 19, 2026 by DarkNet

If you’ve used the internet for more than a few years, the realistic assumption isn’t whether some of your personal information has been exposed in a data breach — it’s how much, and where it ended up. Breaches are now a daily event, and stolen records pile up by the millions every month. The good news: checking your exposure takes minutes, and a handful of concrete steps will neutralize most of the risk. Here’s exactly how.

First, the scale (so the steps make sense)

Data breaches stopped being rare news events years ago. Researchers now track a steady stream of new incidents week after week, with millions of stolen records changing hands. The single most common way attackers get in isn’t some exotic hack — it’s stolen login credentials, followed by phishing and compromised third-party vendors. In other words, the same username and password reused across a dozen sites is the thread that unravels everything.

Once data is stolen, it rarely just disappears. It gets sold, traded, and dumped — often on dark web marketplaces and forums — where it fuels account takeovers, identity theft, and targeted scams. (If you’re curious how that underground economy works and how it gets dismantled, see our breakdown of [how Archetyp Market was taken down] and [how investigators catch the people behind it].) The important part for you: you don’t need to go anywhere near those places to protect yourself. Reputable monitoring services do that scanning for you.

Step 1: Check whether your data is already out there

Start with the free, trusted tools — not random “breach checker” sites you’ve never heard of (more on those below).

The standard first stop is Have I Been Pwned (haveibeenpwned.com). Enter your email address and it tells you which known breaches it has appeared in, and what kind of data was exposed in each. It also has a separate feature to check whether a specific password has shown up in known leaks, without you having to reveal the password itself. Run every email address you regularly use, including old ones.

Then check the tools you may already own:

• Your password manager. Most modern password managers (the breach-monitoring features in 1Password, Bitwarden, Dashlane, and others) flag accounts whose passwords are weak, reused, or known to be leaked.
• Your browser and devices. Chrome, Safari, and the built-in password tools on iPhone and Android will warn you when a saved password appears in a breach. Open the password/security settings and look for a “security checkup” or “compromised passwords” section.

One caveat: a clean result doesn’t guarantee safety. These services only know about breaches that have been discovered and reported, and plenty of stolen data never gets catalogued. Treat “not found” as reassuring, not as proof.

Step 2: If you’re in a breach, do these things now

Finding your email in a breach is normal — almost everyone is. What matters is responding correctly.

1. Change the password on the breached account — to something long and unique you’ve never used anywhere else. Length beats complexity; a long passphrase is both stronger and easier to remember.
2. Kill the reuse. If you used that same password (or a close variation) on any other account, change it everywhere. This is the single most important step, because attackers take leaked credentials and automatically try them across hundreds of other sites.
3. Turn on two-factor authentication (2FA). Prefer an authenticator app or a passkey over text-message codes, which can be intercepted. With 2FA on, a stolen password alone isn’t enough to get into your account.
4. Watch for targeted phishing. After a breach, expect emails and texts that use your real name, the breached company’s name, or other leaked details to look convincing. Treat any “urgent” message with a link or attachment as suspect, and navigate to the site yourself instead of clicking.
5. Check financial accounts if payment or banking data may have been exposed — review recent transactions and consider asking your bank to reissue the card.

Step 3: Lock it down for good

Reacting to one breach is fine; the bigger win is making the next dozen breaches irrelevant to you.

• Use a password manager. It generates and stores a unique strong password for every account, so a leak at one site can’t cascade into the rest of your life.
• Switch to passkeys where they’re offered. Increasingly supported by major platforms, passkeys replace passwords with a cryptographic login that can’t be phished or leaked in the usual way.
• Use phishing-resistant 2FA everywhere it’s available, prioritizing your email and financial accounts — your email is the master key that can reset everything else.
• Keep software and devices updated. A large share of breaches trace back to unpatched, known vulnerabilities.

If sensitive data leaked (Social Security number, financial, or medical info)

When a breach involves more than an email and password — a Social Security number, financial account details, a driver’s license, or medical records — raise your response a level.

• Freeze your credit. In the U.S., you can place a free freeze with all three major credit bureaus (Equifax, Experian, and TransUnion). A freeze blocks new accounts from being opened in your name and can be lifted temporarily whenever you need credit yourself. Consider a fraud alert as well.
• Monitor your statements and accounts closely for unfamiliar activity, and report anything suspicious immediately.
• Use the free protection the breached company offers. Organizations that suffer a breach frequently provide affected people with free credit and identity monitoring for a period of time — take them up on it.
• For tax-related identity theft risk (when an SSN is exposed), be alert to fraudulent tax filings and follow your tax authority’s identity-protection guidance.

Watch out for the second wave: breach-themed scams

A breach creates a second danger that catches people off guard — scammers who exploit the panic.

• Extortion emails are usually bluffing. A message claiming “we have your data/passwords, pay us in crypto or else” is, the overwhelming majority of the time, a mass-sent bluff built on an old leaked password. Don’t pay. Change the password if it’s one you still use, and move on.
• Avoid unknown “check if you were breached” sites. Some exist to harvest the very data they claim to check. Stick to well-known services like the one named above.
• Verify breach notifications independently. If a company emails to say you were affected, don’t click the link — go directly to the company’s official site or your account to confirm.

The bottom line

You can’t stop companies from being breached, and you can safely assume some of your data is already circulating. But that data only becomes dangerous when it unlocks something — a reused password, an un-protected account, an open line of credit. Close those doors with a password manager, unique passwords, 2FA or passkeys, and a credit freeze if sensitive data is involved, and most breaches become a non-event for you. Check your exposure today, fix what you find, and you’ve done more for your security than the vast majority of people online.