My email was leaked: what to do, step by step

Turning up in a breach is more common than it sounds and is almost never an emergency. What decides the outcome is not speed, it is order.

First, what probably happened. A company you signed up with at some point was robbed of its data, and your address was in the batch. It does not mean anyone got into your mailbox, or that today's password is in anyone's hands. It means your address is circulating, and that if a password you reused elsewhere leaked alongside it, there is something to close.

The usual mistake is to react by changing everything at once. Whoever changes twenty passwords in an afternoon ends up choosing twenty variants of the same one, and finishes worse off. Here is what actually helps, in this order.

1. Look at what leaked, not how many times

   Two breaches are not equal. Your address next to a name is noise. Your address next to a password, to security question answers or to card details is a different conversation. Before touching anything, work out which cases involved a password.

2. Start with your email, always

   Your inbox is the master key: it is where the reset links for everything else arrive. If someone gets in there, the rest follows on its own. Give it a long, new password that resembles none of the old ones, and do that before any other site.

3. Turn on two-step verification on that account

   It is the only change on this list that keeps protecting you even if your password leaks tomorrow. Given the choice, use a code app rather than SMS: a phone number can be hijacked with a call to the carrier, an app cannot.

4. Chase the reused passwords, not all of them

   Think back to where you used the password that leaked, or one of its close cousins with a number on the end. Those sites are the real risk, because the common attack does not guess your password, it takes the one already known and tries it against a hundred other services to see which opens.

5. Close the open sessions

   Most large services have a devices or active sessions screen. Changing the password does not always throw out someone already inside: you have to sign them out explicitly. Check your mailbox's automatic forwarding rules too, which is where an intruder hides to keep reading without coming back.

6. Watch anything with money attached

   Banking, wallets, shopping. Nothing needs changing if those passwords were unique: turn on transaction alerts and read them for a few weeks. The early sign of trouble is usually a small strange charge, not a large one.

7. Expect unusually convincing emails

   After a large breach, messages appear quoting real details about you, because whoever wrote them bought those details. An email that knows your name, your bank or an old password proves nothing: that is exactly what leaked. The rule that holds is never to act from the link in the message, but to reach the site the way you normally do.

What does not help

Changing your email address. The leaked address is already out there and cannot be recalled. Moving house is a great deal of work for a benefit that never arrives.

Paying to have your data "erased from the internet". A breach cannot be undone. There are services that remove your details from commercial data brokers, which is a different thing and has no effect on what was already stolen.

Changing your password every three months. That habit was abandoned years ago, in official guidance too, because it pushes people into predictable rotations. One long, unique password you change when there is a reason protects you more than twelve mediocre ones a year.

How to know if you are in the serious part

The question that really matters is not whether your email leaked, but whether one of your passwords is in circulation. That can be checked without handing the password to anyone, and it is explained in how to know if your password was leaked.