MyRecon OSINTHow to Check If Your Email Was in a Data Breach
If you have used the same email address for more than a year or two, the odds are high that it appears in at least one data breach. That is not a reason to panic, but it is a reason to check, and to know what to do next.
What a data breach actually is
A data breach happens when information a company stored about its users is exposed to people who were not supposed to see it. This can be the result of hacking, a misconfigured database left open on the internet, a malicious insider, or a third-party supplier being compromised. When it happens, the stolen data, often millions of records, is frequently traded or dumped publicly.
The records usually contain an email address as the primary identifier, alongside whatever else the service held: a password (sometimes as plain text, sometimes hashed), a username, a phone number, an IP address, a date of birth, or a physical address. Once a dataset like this is circulating, it does not disappear, copies persist indefinitely.
Why it matters even if "it's just an old account"
The single biggest risk from breaches is password reuse. If your email and password leaked from a forum you forgot about in 2016, and you used that same password on your email or bank, attackers can try those exact credentials everywhere else. This automated technique is called credential stuffing, and it works because most people reuse passwords.
Beyond passwords, exposed data fuels targeted phishing. An attacker who knows your name, the services you use, and your phone number can craft a message that looks convincingly real. The more of your data is out there, the easier you are to impersonate or deceive.
How to check your exposure
You can check whether your email appears in known breaches using free, reputable breach-notification services. MyRecon's email tool queries public breach databases and shows you how many breaches your address appears in, along with the categories of data that were exposed (passwords, phone numbers, and so on).
Do this safely. Only ever check your own email addresses, and only use services that look up an address against known breaches, never a site that asks you to enter your current password to "test" it. A legitimate checker never needs your password.
When you run a check, focus on two things: how recent the breaches are, and whether any of them exposed passwords. A recent breach that leaked passwords is far more urgent than a decade-old one that only exposed email addresses.
What to do if your email was breached
- Change the password on the breached service: and on any other account where you used the same or a similar password. This is the most important step.
- Use a password manager so every account gets a long, unique password you never have to remember. This single change eliminates the credential-stuffing risk entirely.
- Turn on two-factor authentication (2FA) everywhere it is offered, especially on your email, banking, and primary social accounts. Prefer an authenticator app or a hardware key over SMS.
- Watch for phishing in the weeks after a breach. Be sceptical of unexpected messages that reference real details about you or create urgency.
- Consider a fresh email for sensitive accounts (banking, government) that is different from the one you hand out publicly.
Reading a breach result properly
A breach checker returns a list of names and dates, and most people stop at the count. The count is the least useful part. What matters is which fields were exposed, because that determines what an attacker can actually do.
Sorted by how much trouble each one causes:
- Plaintext passwords or weak hashes. The worst case. Anything hashed with MD5 or unsalted SHA-1 should be treated as plaintext, those are cracked in bulk. If a password appears here, every account where you reused it is compromised, not just the breached one.
- Security questions and answers. Underrated and often ignored. Your mother's maiden name does not change after a breach, and the same answers are used across many services. Where you cannot remove them, put random text in the answer field and store it in your password manager.
- Phone numbers. The route to SIM-swap attacks, which defeat SMS-based two-factor authentication. A breach exposing your number alongside your email is a reason to move off SMS codes for anything financial.
- Physical address, date of birth, government identifiers. Cannot be rotated. These feed identity fraud and, combined across several breaches, are enough to pass many "verify your identity" phone checks.
- Email address only. The mildest outcome. It means more targeted phishing, not account compromise.
Dates matter too. A breach from 2013 that exposed a password you have since changed is history. One from last year exposing a password you still use is an emergency. Work the list newest-first and by field severity, not alphabetically.
Checking a password without handing it over
There is an obvious objection to password-checking services: to find out whether your password leaked, you appear to have to give it to a website. You do not, and the method that avoids it is worth understanding because it tells you which services to trust.
The technique is called k-anonymity. Your browser hashes the password with SHA-1 locally, then sends only the first five characters of that hash. The server replies with every leaked hash beginning with those five characters, typically a few hundred, and your browser checks the rest of the match locally.
The server therefore learns five hexadecimal characters, which correspond to hundreds of thousands of possible passwords. It never sees your password, never sees the full hash, and cannot determine which of the returned candidates was yours. If a password checker does not work this way, do not use it.
What "not found" does and does not mean
A clean result is good news, with three caveats worth holding onto.
First, it means your address is not in the breaches that particular service has indexed. No service has all of them. Many breaches are never published, traded privately, or published years after the fact, the average gap between a breach happening and becoming public is measured in months, sometimes years.
Second, checking one address checks one address. Most people have several: an old school or university address, a throwaway used for signups, a work address. Forgotten addresses are the highest-risk ones precisely because you are not watching them, and they are often the recovery address on accounts you still use.
Third, a failed check is not a clean check. If a service is rate-limited or unreachable and reports nothing, that is the absence of evidence and not evidence of absence, a distinction that matters more than it sounds, because a silent failure looks exactly like good news.
Monitoring without giving your address away
Checking once tells you about today. The useful version is being told when something new appears, and there are two ways to do that with very different privacy costs.
The catalogue approach. The list of known breaches, names, dates, how many accounts, which fields, is public. A tool can download that list and compare it against what it showed you last time, entirely on your own device. Nothing about you is transmitted, no account is required, and you learn immediately when a breach is published so you can check whether you used the service.
The per-address approach. Genuinely answering "was I in it" requires sending your address to a service that holds breach records. That is a real disclosure, and any service offering it should say so plainly rather than burying it. It gives you a definite answer where the catalogue approach only gives you a prompt to go and check.
Neither is wrong; they are different trades. What matters is that a service tells you which one it is doing. Anything advertising "we never send your data anywhere" while also telling you which specific breaches you appear in is describing something impossible.
How to reduce future exposure
You cannot un-leak data that is already out, but you can limit how much new data accumulates. Use unique passwords, delete accounts you no longer need, and think twice before handing your real email to every website that asks. Email aliases and "plus addressing" (for example, you+shop@gmail.com) can help you compartmentalise and even trace which service leaked or sold your address.
Want the full routine? Read our guide on how to reduce your digital footprint, or run a quick self-check with the MyRecon email tool.