Breach Check

How to complete Breach Check

Your email address has almost certainly appeared in at least one data breach; the real question is whether the leaked passwords still open anything. Twenty minutes of checking and rotating shuts down credential stuffing, which is how most accounts actually get hijacked.

1. Go to haveibeenpwned.com and check every email address you use, including old ones that still forward to you.
2. For each breach listed, note whether passwords were exposed and which of your accounts used that password.
3. Change the password on every affected account, plus every other site where you reused it: the reuse is the actual vulnerability.
4. Generate replacements with a password manager: unique per site, never a variation of the old one.
5. While you are in the settings, enable two-factor authentication on email, banking, and anything storing a card.

Tips

• Your email account is the crown jewel because it can reset everything else, so secure it first.
• Subscribe to breach notifications on the same site so future leaks come to you automatically.
• Appearing in a breach does not mean you were hacked; it means exposed. No panic, just rotation.

What counts as done

Every address checked, and every password tied to a breach replaced with a unique one.