Email in Data Breach: What to Do in the First Hour

The email arrives on a Tuesday: “Your address was found in a new data breach.” The instinct is to change everything at once. Understandable, but it often means the most important account gets done last. There’s a sensible order, and it starts somewhere most people don’t expect.

First: what exactly leaked?

Before changing anything, look at which data the breach contained. Have I Been Pwned lists the exposed data types for each breach; the walkthrough is in check if your email was in a data breach.

Roughly three cases:

• Email address only, maybe with a name. No account is directly at risk. Expect more spam and better-targeted phishing.
• Email plus password hash. It depends on how the site stored passwords. Unsalted MD5 or SHA-1 falls to a cracking rig in minutes for common passwords; bcrypt or Argon2 takes far longer. Treat the password as known anyway.
• Email plus plain-text password. Urgent. Do everything below now.

Email in data breach, what to do: the first 60 minutes

Email comes first even when the breach was somewhere else entirely. Nearly every site has a “forgot password” link, and that link goes to your inbox.

Looking for traces in your mailbox

Someone who gets into a mailbox usually wants to stay unnoticed. The giveaways are small changes that can sit there for months:

• A forwarding rule to an outside address, sometimes only for messages containing words like “invoice”, “password” or “bank”.
• A filter that moves security alerts straight to trash or an obscure folder.
• App passwords or connected apps you don’t recognise. These often keep working after a password change.
• Changed recovery details: a new phone number or backup address.

In Gmail, forwarding sits under Settings → Forwarding and POP/IMAP, and recent sessions under “Last account activity” at the bottom of the inbox. Microsoft shows sign-ins at account.microsoft.com under Security → Sign-in activity.

Changing passwords properly

A new password built on the old pattern (Summer2024# becomes Autumn2026#) achieves little; attackers try those variations on purpose. The replacement should be random and used nowhere else. With more than a handful of accounts that isn’t realistic without a password manager.

Where a site offers it, a passkey is the better choice. A passkey can’t leak in usable form from a breached server, because the service only stores the public key.

If you’re locked out already

Worse than a leak is finding the password already changed. Now speed matters, because the attacker is using that time to reset your other accounts.

Use the provider’s recovery route straight away, via the phone number or backup address on file. If those were changed too, Google and Microsoft both have recovery forms that ask about old passwords, when the account was created and frequent contacts. The more details you can supply, the better your chances.

Meanwhile, warn your bank and key contacts through another channel so nobody falls for messages “from you”. With your own domain you are in a stronger position here: you can point the MX records at a new provider and regain control of all incoming mail, even if the old mailbox is lost.

The weeks after: phishing with real details

A breach is often just the start. Criminals use the leaked data to write convincing messages that quote your name, a customer number, maybe a recent order. The link leads to a copy of the login page.

The rule is simple: whenever an email asks you to sign in, go to the site yourself, through a bookmark or the app, never through the link. If a message claims to come from your own company, check the sender. How organisations protect their domain against exactly that is covered in prevent email spoofing.

When the address is on your own domain

Two extra points apply. First, check who can access your domain registrar account. Someone who takes it over can change the MX records and read every message to your domain, password reset links included. That account needs its own strong password and 2FA. More on that in account recovery email on your own domain.

Second, from now on you can give every service its own address. If [email protected] turns up in a leak, you know the source immediately and can shut down that one address. The how-to is in catch-all email address.

To register your own domain for email at betadomain, a .com costs €14.99 a year and a .co.uk €15.99. Renewals cost the same as the first year, as the price overview shows.

Step by step

1. Secure your email account firstChange your email password even if a different site was breached. Whoever controls your inbox can reset every other password.
2. Check sessions and rulesSign out all other devices, then review forwarding, filters, app passwords and connected apps in your email account.
3. Change the breached and reused passwordsChange the password on the breached service and on every account where you used the same or a similar password.
4. Turn on two-factor sign-inEnable 2FA with an authenticator app or passkey, starting with email, then banking, shops with saved cards and cloud storage.
5. Expect follow-up phishingFor the next few weeks, treat messages quoting real details from the breach with suspicion and go to sites directly rather than through links.