If your email showed up in a breach

A breach listing means that address appeared in a known leak. It does not automatically mean someone is in your inbox right now. It is a prompt to tidy the accounts tied to that address, especially if a password or other login data was part of what leaked.

This is general defensive guidance, not a personal incident response and not a guarantee.

1. Change the passwords that matter

Start with the services named in the result, then anywhere you reused the same password. A leak on one site is how reused logins fall over on others.

Pick a unique password for each important account, ideally from a password manager. Do not type a new password into a link that arrived in an unexpected email or message about the breach.

If the listing included passwords, password hints, or security questions, treat those as public and replace them.

2. Turn on two-factor authentication

Wherever an important account offers an app-based code or a security key, turn it on. SMS codes are better than nothing, but they are weaker than an authenticator app or a key.

Also check the recovery email and phone number. If those have been changed, recover the account through the official site or app before you do anything else.

3. Watch for follow-on phishing

Attackers like to ride a public leak: “We noticed your account was in a breach, click here to secure it,” or a payment request that claims to be cleanup. Open the real site yourself by typing the address you already know, or use the official app. Do not use a link or phone number from the unexpected message.

A family or work code word still helps if someone then calls or sends a voice note asking you to move money or share a one-time code.

4. If financial or identity data was exposed

If bank details, government IDs, or other identity data were on the list, watch statements and official accounts more closely for a while, and use the official channels for your bank or tax authority if something looks wrong. Do not pay a “cleanup” service that contacted you first.

5. Keep the rest of the team in the habit

For a business, confirm payment-change rules still require a call-back on a number you already have, and that more than one person signs off unusual transfers. The AI-safety checklist for businesses is a short list you can tick with the team.

You can re-run a check any time with Breach Monitor. Amniat does not store the email you type in, and a “no known breaches” result is good news — not a promise that a new leak will never appear.