How to Check If Your Email Has Been in a Data Breach

Over 11 billion individual credentials have been exposed in documented data breaches worldwide. That number grows every day. If you have used the internet for any length of time, there is a significant chance your email address — and possibly your password — has appeared in at least one breach.

The good news: checking is free, fast, and the first step toward protecting yourself. Here is how to do it.

Step 1: Check Your Email Against Known Breaches

The fastest way to check is with our free Breach Scanner. Enter your email address and within seconds you will see a list of breaches where your credentials were exposed, including what data was leaked (passwords, names, phone numbers, financial information).

We check against aggregated breach databases that include data from major incidents as well as smaller, less-publicized breaches. The results show you exactly which services were compromised and when.

Step 2: Understand What Was Exposed

Not all breaches are created equal. The severity depends on what data was leaked:

• Email + password: The most dangerous combination. If you reuse this password anywhere, every account using it is at risk.
• Email + name + phone: Used for targeted phishing and social engineering attacks. Criminals can craft convincing messages using your real information.
• Financial data: Credit card numbers, bank account details, or billing addresses. Monitor your accounts immediately.
• Personal identifiers: Social Insurance Numbers, dates of birth, or addresses. These enable identity theft and can take years to fully remediate.

Step 3: Take Immediate Action

If your email appears in any breach, take these steps right away:

1. Change the password on the affected service immediately. Use a strong, unique password (at least 16 characters, mixing letters, numbers, and symbols).
2. Change it everywhere else you used the same password. This is the most critical step. Password reuse is how a single breach becomes a cascade of compromised accounts.
3. Enable two-factor authentication (2FA) on every account that supports it. Even if your password is stolen, 2FA adds a second layer that attackers must bypass. Use an authenticator app rather than SMS where possible.
4. Monitor your financial accounts for unauthorized transactions. If financial data was exposed, consider placing a fraud alert with Equifax Canada or TransUnion Canada.
5. Watch for phishing. After a breach, you may receive convincing-looking emails using your leaked personal information. Be suspicious of unexpected emails asking you to click links or verify account details.

Step 4: Prevent Future Exposure

You cannot control whether a service you use gets breached. But you can limit the damage:

• Use a password manager. Tools like Bitwarden, 1Password, or KeePass generate and store unique passwords for every account. You only need to remember one master password.
• Never reuse passwords. Every account should have a unique password. A password manager makes this practical.
• Enable 2FA everywhere. Prioritize email accounts, banking, and any service that stores sensitive data.
• Use email aliases. Some email providers let you create aliases or plus-addressing (you+service@email.com) so you can track which services share or leak your data.
• Check regularly. Breaches are discovered months or years after they happen. Check your email every few months using our Breach Scanner.

Why This Matters for Canadian Businesses

Under PIPEDA, Canadian businesses are required to report breaches that create a real risk of significant harm. But you cannot report what you do not know about. Regularly checking whether your organization's credentials have been exposed is a baseline security practice.

Employee credential theft is one of the most common initial access vectors for ransomware attacks. If an employee's corporate email and password were leaked in a third-party breach and they reused that password for their work VPN, an attacker has a direct path into your network. Checking for exposed credentials is not optional — it is essential.