Practical recovery
Received a data breach email? Start with these five checks.
Not sure whether a breach email is genuine? Check the message safely, understand what was exposed and decide which account-security steps come first.
By securemypassword.co.uk · · 3 min read
Practical guide · reviewed 27 October 2026
Sources checked 27 October 2026. This is a dated account; later findings may change the picture.
1. Check the message without using its links
A company says your information may have been exposed. Your first question is probably whether the email itself is real. That is a sensible place to start: the NCSC warns that criminals use breach announcements as material for convincing scam messages, including messages sent to people who were not affected.
Open the company’s usual app or type its website address yourself. Look for an incident notice there and use its published contact routes if you need clarification. A familiar logo, your name or an old password in a message does not establish who sent it. Do not give a caller a verification code or install software because they offer to fix a breach.
2. Read what was exposed, rather than just the headline
Look for the part of the notice that describes the information involved. Names and email addresses, passwords and payment information raise different questions. If the notice says information may have been accessed, keep that uncertainty in your understanding of the incident. A long list of possible fields does not establish that every field belonged to every person.
On our results page, Breach datasets counts historical datasets containing the checked address. Datasets listing passwords counts datasets that list passwords among their data types. It does not establish that your exact or current password appears in the record. The next useful question is whether you still use a password that the incident advice says needs replacing.
3. Deal with password reuse and recovery access
If the affected service tells you to replace a password, do it through its official settings. Replace that password on other accounts where you reused it too. Make each replacement unique, and save it in a password manager you trust. Follow any incident-specific instructions the organisation publishes.
Give your recovery email particular attention: it is often where password-reset messages for other accounts arrive. Review recovery details, unfamiliar sessions and two-step sign-in through the provider’s own security settings. If the provider offers a passkey, read its setup and recovery guidance. Our account guides help you organise these checks; you make the changes on the provider’s website.
4. Use a breach check for the question it can answer
A verified email check on securemypassword.co.uk asks whether your address appears in the known datasets returned by Have I Been Pwned. It does not scan your inbox, look inside a company’s investigation or test whether an attacker can sign in. Sensitive and retired breaches are omitted by the public API, and unreported incidents may not appear.
HIBP’s email results do not provide a password alongside your address. Our separate password tool asks a different question: whether the password value appears in Pwned Passwords. Your browser hashes it locally and sends only a five-character hash prefix. Neither a password match nor an email match identifies current access to an account. A no-match result is not proof of safety.
5. Keep an action list, rather than chasing a clean score
Write down which changes you have actually completed and which still need attention. A useful record might say that you replaced a reused password, checked recovery details and confirmed a fresh sign-in. It should not say an account is secure merely because you ticked a box.
Historical breach records can remain visible after you change a password. HIBP explains that those records describe what happened in the past; a later password change does not erase that history. On this site, resolved means you completed your action steps. If you discover unfamiliar activity or cannot sign in, use the affected provider’s official recovery process instead of relying on a breach search alone.
Choose your next step
- Check whether your email appears in known breach datasets
- Check a password separately, using local hashing
- Learn how to check a suspicious breach message
- Work through official account recovery guides
Email checks require ownership verification. Dataset matches do not prove current account access or your exact password. Password checks cannot identify the account a password came from. This is guidance, not incident response or personalised legal advice.
Sources & editorial notes
- NCSC: data breaches and actions to take
- NCSC: protecting email and using two-step verification
- Have I Been Pwned: breach records, passwords and coverage
- Have I Been Pwned: Pwned Passwords range API
Our explanation draws on the public notices linked above. We do not host leaked datasets, independently confirm individual records or imply these incidents are all searchable here. For personal incident questions, use the affected organisation’s official channels. Corrections: hello@dayadata.co.uk.