Data breaches happen constantly. Companies you have signed up with in the past may have been hacked without you ever being told. When that happens, your email address and potentially your password end up in databases that criminals buy and sell.
Checking whether your email has been exposed is quick, free and something every business owner and employee should do.
How to check using Have I Been Pwned
The most trusted tool for this is a website called Have I Been Pwned, created by security researcher Troy Hunt. Go to haveibeenpwned.com. Type your email address into the search box and click the pwned button. The site will tell you whether your email address has appeared in any known data breaches. If it has, it will list which breaches and what type of data was exposed such as email addresses, passwords, phone numbers or physical addresses.
What to do if your email has been breached
Do not panic, but do act. If your email appears in a breach, change your password on the affected service immediately. If you used the same password on any other accounts, change those too. This is the most important step because criminals try stolen passwords across multiple services automatically.
Enable multi-factor authentication on every account that supports it. This means that even if someone has your password they cannot log in without a second verification step. Our guide on how to create a strong password covers what a good replacement password looks like, and you can use our free password generator to create one.
How to check for breached passwords specifically
On the same site, click the Passwords tab at the top. You can type in a password to check whether it has appeared in any known breach. The password is not sent to the server in plain text so it is safe to use. If a password you are currently using shows up, change it immediately on every account where you use it.
Should you check your work email too?
Yes. Business email addresses are just as likely to appear in breaches, especially if employees have used their work email to sign up for third party services. If your work email and password have been exposed, an attacker could potentially access your business email, cloud storage, client data and internal systems.
Set up breach notifications
On Have I Been Pwned you can subscribe to notifications for your email address. If your email appears in a future breach, you will receive an alert so you can act quickly rather than finding out months later.
When to get help
If you discover that a business email has been compromised, especially if the same password was used for Microsoft 365 or other business systems, contact your IT provider immediately. Recloud can check for signs of unauthorised access, reset credentials across your organisation and make sure your accounts are properly secured.