How to Check If Your Email Address Has Been in a Data Breach
Billions of email addresses have been leaked in data breaches. Here's how to find out if yours is one of them — and what to do if it is.
In the last decade, billions of email addresses and passwords have been stolen from companies and posted to hacker forums, sold on dark web marketplaces, or leaked publicly. Chances are, at least one of your email addresses is in a breach database right now.
The question isn't really if your email has been exposed — it's how many times, and what was leaked alongside it.
What Is a Data Breach?
A data breach occurs when an attacker gains unauthorized access to a company's database and extracts user records. These records typically include email addresses and hashed (or in some cases, plaintext) passwords. They often include additional data: names, phone numbers, dates of birth, physical addresses, and purchase history.
The stolen data is usually published on dark web forums or sold to other criminals. From there, it circulates for years — being repackaged, resold, and used in credential stuffing attacks against other services.
Major breaches you may have been caught in include:
- LinkedIn (2021) — 700 million records
- Facebook (2021) — 533 million records
- Adobe (2013) — 153 million records
- Yahoo (2013–2014) — 3 billion records
- Canva, Dropbox, Twitch, Gravatar, and hundreds more
Why It Matters Even If You Changed Your Password
Many people assume that changing a password after a breach is enough. It's not — for two reasons:
1. Password reuse. If you used the same password on multiple sites, attackers try it everywhere. They call this credential stuffing. A leaked password from a 2015 forum breach might still open your email account today if you haven't changed it everywhere.
2. The other data doesn't expire. Your email address, phone number, name, and date of birth don't become useless after a breach. They're used for phishing, SIM swapping, identity theft, and social engineering attacks for years.
How to Check If Your Email Was Breached
Option 1: Shadow-Trace (Recommended)
Shadow-Trace scans your email address against dark web breach databases and returns a detailed report — which breaches you were caught in, when they occurred, and what data was exposed in each one. Results are organized and explained in plain language, not raw data dumps.
Shadow-Trace also checks for other exposure beyond breach databases: old social media accounts, public records, and data broker listings tied to your email.
Option 2: HaveIBeenPwned
HaveIBeenPwned is a free service that checks your email against known breach databases. It's the most widely used breach check tool and is run by security researcher Troy Hunt. It's an excellent first check but focuses exclusively on breaches — it won't show you broader digital exposure.
What to Do If Your Email Was Exposed
If Your Password Was Leaked
- Change the password immediately on every site where you used it.
- Enable two-factor authentication (2FA) on your most important accounts — email, banking, and social media first.
- Use a password manager so every account has a unique, random password going forward.
If Your Personal Data Was Leaked
- Be extra vigilant about phishing emails. Attackers with your real name, email, and partial account history craft very convincing fake messages.
- Monitor your credit. If your address or date of birth was in the breach, watch for signs of identity theft — unexpected credit inquiries, accounts you didn't open.
- Consider a credit freeze if sensitive financial data was exposed.
How to Stay On Top of Future Breaches
Breach monitoring is the practice of continuously watching for new breaches that include your email address — alerting you when your data surfaces in a fresh leak, rather than finding out months or years later.
Shadow-Trace offers breach monitoring as part of its subscription — adding your email address to a watchlist that checks against new breach data as it becomes available and sends an immediate alert if your information is found.
Given how regularly major companies are breached, this kind of continuous monitoring is more practical than periodic manual checks.
The Bottom Line
Checking whether your email has been in a data breach takes about 30 seconds. The information it gives you — what was exposed, when, and by which company — is directly actionable. If you haven't checked recently, do it now.
Shadow-Trace runs a free breach check alongside a full scan of your digital footprint. Enter your email address and see your full exposure report in seconds.