Your email was exposed, but passwords are not listed. What now?

Start with the information described

An email address in a breach record is a reason to review the evidence, but it is not automatically a password leak. Start with the information described in the source and the organisation's current advice. You can take contact-data exposure seriously without assuming that every password you use has been stolen.

Read the fields before choosing an action

There are two different statements to watch for: a dataset does not list passwords among its data types, or an organisation says its investigation found no password access. Preserve that distinction when you make notes. Neither statement is a complete assessment of all your other accounts.

A list of possible fields also does not establish that every person lost every listed field. Read the source's explanation of individual uncertainty. Avoid turning “may include” into “definitely included”, or a dataset description into a personalised inventory.

HIBP's FAQ explains why records without login credentials can still matter for privacy. An email lookup and a separate password check answer different questions; one should not be presented as the other's result.

A real example, with a clear boundary

ASOS's current customer update reports access to some personal information while saying its investigation found no account-password or payment-card access. That is the company's finding about this incident, not a promise about unrelated accounts.

Our ASOS explainer separates the dated notices from the actions a reader can take. Do not assume an incident appears in HIBP merely because we have written about it.

A hypothetical message that knows an old address

Imagine a message offering a refund. It uses your name and an old delivery address, then asks you to sign in through its link. The example is hypothetical, not a report about a real customer or sender.

The personal detail makes the message feel relevant. It does not establish who sent it. Instead of deciding from the message alone, open the retailer's usual app or independently find its official website. Look for the notice or use its published support route.

Write your question before contacting support: “Does this notice apply to me, and what action are you asking me to take?” That keeps the conversation focused. You do not need to send a password, a verification code or a screenshot containing private account information to this checker.

Choose a proportionate next step

1. Find the official notice independently. Keep the original message as evidence without relying on its links.

2. Note which information is described, what is uncertain and whether the organisation requests any action.

3. Be cautious with unexpected follow-up requests, even when they mention familiar details.

4. Review any relevant password reuse or account warning separately, through the provider's official settings.

5. If you find unfamiliar account activity, use the provider's recovery route rather than treating an email-search result as the diagnosis.

The NCSC's guidance explains independent verification and account checks after a breach. Our message-checking help and official recovery guides provide practical starting points.

Keep the reason for each action visible

You might decide to change a reused password as routine account protection. Record that reason without calling it proof that this particular incident exposed the password. Equally, a unique password is not a guarantee that every possible account threat has been removed.

A short note can separate the tasks: “read notice”, “checked official advice”, “reviewed relevant account”, “question still open”. Mark an item complete after you finish it, rather than after opening a link. This site does not make account changes for you.

What remains unknown

A no-match email result cannot rule out an incident, and a contact-only record cannot identify all consequences for an individual. Follow the organisation's current advice even when the checker has no matching record.

Your next step is to read the source behind the result and identify one action the evidence supports. You do not need to invent a password leak to justify being careful with unexpected messages.