What to Do After Have I Been Pwned Finds Your Email in a Breach: Sort Risk First in 2026

FTC guidance describes two-factor authentication as requiring a second way to prove it’s you, in addition to your password. Its account-protection advice points to an important distinction: a breach listing and an account takeover are different problems.

Symptom: Have I Been Pwned lists your email address.
Fastest response: Check what data the record says was exposed, then act on password reuse or signs of mailbox access—not on the address listing alone.

This guide is for people who found their address in a breach record and need to distinguish exposure from account compromise.
It’s also for anyone deciding which reused passwords to replace first, or whether to separate addresses for future signups.
If the account is important for recovery, keep it tied to an email address you can control long-term.

An exposed address is not the same as an exposed mailbox

A Have I Been Pwned result links an email address to breach data the service knows about. It does not, by itself, confirm that someone signed in to the mailbox, learned its password, or can control other accounts linked to it. The official Have I Been Pwned FAQ explains the scope and limits of breach results. Read the specific incident description and listed data types before deciding what to change.

Separate three questions that are easy to collapse into one:

• Was the address included? The record may show that a site or dataset associated your email address with an incident.
• Were credentials or other sensitive data included? Check whether the incident description lists passwords, account credentials, or other personal information. A listed address alone does not establish that a password was part of the exposed data.
• Was the mailbox itself accessed? Look for evidence in your email provider’s account activity and settings. The breach listing cannot answer this question.

The distinction matters because the remedy depends on the exposed data. Changing your mailbox password may be important if it was reused or if the mailbox shows signs of unauthorized access. It will not remove your address from a breach record, and it may not address a password left active on the affected website.

A search with no result also has limits. It means the service does not currently show a matching record in its available data; it does not prove that your address has never been exposed or that every account using it is safe. Treat breach notices, account activity, and password reuse as separate evidence.

Password reuse raises the priority

When a record includes a password or credentials, first identify whether that password is still in use on the affected service. If it is, change it there. Then check for the same password and close variations on other accounts. Reusing one password means a credential exposed in one place may put other accounts at risk; a unique password limits that connection.

Prioritize accounts by what an attacker could reach or reset through them. Your primary email account deserves particular attention because it may receive password-reset links for other services. Accounts that hold payment details, financial access, or important personal records also warrant care. For these, use a long-term address you can recover and secure with credentials that are not used elsewhere.

The FTC’s consumer guidance on data breaches recommends taking steps such as changing exposed passwords and protecting accounts. The right scope depends on the record and your own password habits: if the password was unique and is no longer active, there is no reason to assume every other account needs a password change. If it was reused, update each affected account instead of changing only the password on the breached site.

For accounts that support it, turn on multifactor authentication after securing the password. The FTC’s explanation of two-factor authentication describes additional ways to verify access, including authentication apps and security keys. Choose an option available from the service and keep recovery methods up to date. A second check helps protect access if a password is known, but it does not make password reuse a good practice.

A password manager can help you maintain unique credentials instead of relying on small variations of one familiar password. The CISA password-manager guidance explains how password managers support creating and remembering strong passwords. This is especially useful when you need to replace credentials across several accounts without creating another pattern that is easy to guess.

Check mailbox access separately

If the concern is that someone may have entered your email account, look for account-level clues—not just the breach result. Examples include an unfamiliar security alert, account recovery details you did not change, messages you did not send, unexpected sign-in activity, or a forwarding rule you do not recognize. Any one clue may need context, but an unexplained change to access or recovery settings deserves prompt attention.

If you cannot sign in, or you find signs that someone changed security settings, follow your email provider’s official recovery process. Do not treat changing a password on the breached website as a substitute for recovering and securing the mailbox. The FTC’s guide to recovering a hacked email account covers recovery actions and account security checks.

After regaining access, review the mailbox’s security settings and recovery details. Remove unfamiliar recovery options or forwarding rules, and update the mailbox password if it may have been exposed or reused. Then review other accounts that rely on this address for password resets. If you cannot access the provider’s recovery channel, use the provider’s official account recovery page rather than links from unexpected messages.

Choose the next action by risk, not by the search result alone

Use these conditions to decide what to do next:

• If the record lists only an email address and you see no mailbox warning signs, review the incident details and keep your mailbox under normal observation. Do not abandon your primary email based on the listing alone.
• If the record includes a password you still use on that site, change it on that service and replace it anywhere else you reused it. Make each new password unique.
• If the password was reused on your email account, secure the mailbox as a priority, review its recovery methods, and enable multifactor authentication if available.
• If you see unfamiliar mailbox activity, cannot sign in, or find security settings you did not change, use your email provider’s official recovery process. Treat it as possible account access, not simply as a website breach.
• If the address is used for banking, payments, government services, or other accounts that require dependable recovery, keep a long-term address you control. Do not move those accounts to a disposable inbox.
• If the address is only for a low-trust or short-lived signup, consider using a separate address for future registrations. That can help keep later mail separate; it cannot undo an earlier exposure or prove who shared your address.

This approach prevents two costly mistakes: changing a primary address without a recovery plan, and overlooking reused credentials because the result appears to show only an email address. An address appearing in breach data is a signal to investigate, not a universal instruction to replace every account.

Separate future signups without breaking account recovery

For future registrations, address separation can limit how much routine mail reaches your primary inbox and may make it easier to identify which address received a message. The useful question is not whether a separate address makes you anonymous—it does not—but whether the account can safely function without a permanent recovery route.

Before using a temporary inbox or another address for a new signup, check whether you may need to verify the account again, reset its password, receive a later security alert, or contact support. If losing access to that address could lock you out, use an address you control over the long term. This applies especially to financial, government, and other high-consequence accounts.

A temporary address can be more appropriate for a low-trust site, a one-time download, or a signup where future access is not important. An alias or forwarding address may fit better when you want separation but still need incoming messages to reach an inbox you control. TempPin’s email forwarding information is one place to review when comparing that approach with temporary receiving.

Address separation is a forward-looking privacy measure. It does not erase a past breach record, remove data already copied by others, or establish that a particular website sold your address. For a broader view of how an address choice relates to privacy, consult TempPin’s privacy information.

Common questions about breach results

Does an address in a breach record mean the email account was stolen?

No. The record associates the address with breach data known to the service; it does not prove that anyone logged in to the mailbox. Check the incident’s listed data types, then look separately at your email provider’s security activity, recovery details, and forwarding rules. If you find unfamiliar account changes, use the provider’s recovery process.

What if the record shows an email address but no password?

Review the incident description and any related notices, but do not infer that a password was exposed when the record does not say so. Check whether you reused the affected site’s password elsewhere and whether your mailbox shows unusual activity. If neither applies, the address listing alone is not a reason to abandon a primary email account.

Should you change passwords on other sites too?

Change passwords on other services if you reused the exposed password or a close variation there. Start with the email account and services that can reset or unlock other accounts. Use a distinct password for each service, then enable multifactor authentication where available. If the password was unique and is no longer active, assess other accounts on their own evidence.

What are signs that someone accessed your mailbox?

Look for unfamiliar sign-in alerts, changes to recovery details, messages you did not send, unexpected forwarding rules, or trouble signing in. These signs concern the mailbox itself; a breach listing does not confirm them. If you find an unexplained change or lose access, follow the email provider’s official account recovery guidance and secure the account before changing other recovery details.

Put address isolation in the right place

A breach result calls for risk sorting, not an automatic email migration. First check what the record says was exposed, replace credentials that remain active or were reused, and investigate mailbox activity through the provider if anything looks wrong. Keep important accounts on an address that remains under your control.

For future low-trust signups, a separate receiving address can keep that activity apart from your primary inbox, but it cannot retract an existing breach. If that separation fits the account’s recovery needs, review TempPin’s temporary email options and choose an approach that does not put important, long-term access at risk.

Frequently asked questions