Check If Your Email or Phone Number Was Leaked (2026)

Quick answer

To check if your email was leaked, enter it at haveibeenpwned.com, which lists the breaches it appeared in. Check your saved passwords with Google Password Checkup or your password manager's security report. There is no reliable free checker for phone numbers, so assume yours is exposed if a breached account held it. Then change any reused passwords, turn on passkeys or app-based two-factor authentication, add a carrier PIN, and freeze your credit (US) or consider Cifas Protective Registration (UK).

Key numbers

17.8 billionbreached accounts searchable on Have I Been Pwned, from more than 1,000 breached websitesHave I Been Pwned
$1.31 billionlost in 2025 across 67,456 personal data breach complaints to the FBIFBI IC3 2025 Internet Crime Report
38%rise in unauthorized SIM swaps recorded in the UK National Fraud Database in 2025Cifas Fraudscape 2026
4.46 millionpeople had names, Social Security numbers and dates of birth exposed in the TransUnion breach in 2025SecurityWeek

You got an email saying a company you used "experienced a security incident". Or a scammer texted you by name. Either way, the question is the same: what of mine is out there, and what can someone do with it? Have I Been Pwned, the best-known breach checker, holds more than 17.8 billion breached accounts. The odds that at least one of yours is in there are high.

A leak is not the same as being hacked. But it hands criminals the raw material for phishing, account takeover and identity fraud. The FBI logged 67,456 personal data breach complaints in 2025, with reported losses of $1.31 billion. The steps below take about 30 minutes and close most of the doors a leak opens.

How do I check if my email was leaked in a data breach?

Enter your email address at haveibeenpwned.com. It is free, run by security researcher Troy Hunt, and lists every known breach your address appeared in, with the date and the types of data exposed.

Check every address you have used, including old work, school and throwaway emails.
Read each breach entry. Note what leaked: passwords, phone numbers, addresses, dates of birth, security questions.
Prioritize breaches that included passwords or government ID numbers, and any account you still use.
Turn on Notify me so you get an email when your address shows up in a future breach.

"No breaches found" doesn't mean you are safe. Many breaches are never made public, and some data is sold privately. Treat it as good news, not a guarantee.

How do I check if my passwords were leaked?

Use Google Password Checkup at passwords.google.com if you save passwords in Chrome or Android. It tells you which saved passwords have been compromised and which are weak. Apple's Passwords app and most password managers have a similar security report.

You can also test a single password on Have I Been Pwned's Pwned Passwords page. It never sends your password: your browser hashes it and sends only the first five characters of the hash, then compares the results on your device.

A leaked password matters most if you reused it. Criminals take leaked email and password pairs and try them on banks, email, shopping and social accounts automatically. That is called credential stuffing, and it is why one old breach can open ten accounts.

How do I know if my phone number was leaked?

There is no reliable free tool that checks phone numbers across all breaches, so the honest answer is: if any breached account held your number, assume it is exposed. Strong signs include a jump in scam calls and texts, texts that use your name, and one-time codes you didn't request.

Your number is also probably public in other ways. People search sites, old listings and social profiles connect phone numbers to names and addresses. To see what a stranger can link to you, run a Search A-Z Check yourself search. The report shows the public profiles, web mentions and work details tied to your name, and checks whether a phone number or email you enter is real, what type of line it is (mobile, landline or internet/VoIP) and whether it carries a fraud risk. US searches can include public records such as addresses and phones.

What were the biggest data breaches in 2025 and 2026?

Recent breaches mostly exposed contact details and identity data rather than card numbers, which is exactly what scammers use for phishing and impersonation. A few of the largest:

Breach	People affected	What leaked
Co-op, UK (April 2025)	6.5 million members	Member contact details; no financial or transaction data
TransUnion, US (July 2025)	4.46 million	Names, Social Security numbers, dates of birth
Carnival, US (April 2026)	5,995,277	Names, emails, dates of birth, loyalty details (varies)
ADT, US (2026)	About 5.5 million (per Have I Been Pwned)	Names, phone numbers, addresses; some birth dates and partial SSNs
Panera Bread, US (2026)	About 5.1 million emails (per Have I Been Pwned)	Names, emails, phone numbers, addresses

The Carnival breach started with social engineering: an attacker tricked an employee into granting access, according to Malwarebytes. In mid-2025, headlines warned of "16 billion passwords leaked". BleepingComputer reported it was a compilation of old breaches and infostealer malware logs, not a new breach. It was still a good reason to stop reusing passwords.

What can scammers do with my leaked data?

Scammers use leaked data to make their approaches believable and to get past security checks. The main risks:

Targeted phishing. A message that uses your name, the company that was breached and your real order or account details. They often pose as the breached company offering "compensation" or "account verification".
Account takeover. Leaked passwords tried on your email, bank and shopping accounts. Cifas recorded more than 78,000 UK account takeover cases in 2025.
SIM swap. With your name, number and date of birth, a criminal convinces your carrier to move your number to their SIM, then receives your text codes. The FBI received 971 SIM swap complaints in 2025 with $17.4 million in losses, and Cifas saw a 38% rise in UK cases.
Identity fraud. Opening credit, phone contracts or accounts in your name. Identity fraud made up 54% of all cases in the UK National Fraud Database in 2025, more than 242,000 cases.
Impersonation of you. Messages to your contacts or employer that appear to come from you, sometimes from a lookalike email address.

A typical follow-up scam message looks like this:

Hi [your name], following the recent data incident at [company], your account has been flagged. To keep access and claim your compensation, please verify your details within 24 hours: [link]

Never click links in breach messages. Go to the company's website or app yourself. If a message asks you to verify an email sender or payment details at work, our guide to verifying an email sender walks through the checks.

What should I do if my data was leaked?

If your data was leaked, change any exposed or reused passwords, turn on stronger sign-in, protect your phone number and lock your credit. Do it in this order:

Secure your main email first. It resets everything else. New unique password, then two-factor authentication.
Change every reused password. Use a password manager so each account gets a unique one. If you think your computer has malware, scan it first, or the new passwords can be stolen too.
Switch to passkeys where offered. Google, Apple, Microsoft, Amazon, PayPal and many banks support them. Passkeys can't be phished or reused.
Use an authenticator app, not SMS, for two-factor codes on important accounts. SIM swaps intercept text codes.
Add a carrier PIN or SIM lock. Ask your mobile carrier for a port-out PIN or number lock so nobody can move your number without it.
Freeze your credit (US). It is free, doesn't affect your score, and stays until you lift it. Do it at all three bureaus: Equifax, Experian and TransUnion. A free fraud alert, placed with one bureau, lasts a year.
Watch your accounts. Check bank and card statements, and your credit report, for anything you don't recognize.

UK: Cifas Protective Registration

UK residents whose identity details have leaked can buy Cifas Protective Registration, which costs £30 for two years. It flags your name and address in the National Fraud Database, so lenders and phone companies run extra checks before opening anything in your name. Genuine applications may take a little longer, and it doesn't affect your credit score. Cifas says it is most useful in the first months after a leak. Also check your credit report with Experian, Equifax or TransUnion UK.

EU: what differs

The EU has no single credit freeze system. Tell your bank, watch your accounts, and know that a company that suffers a breach must report it to its data protection authority and, where the risk is high, tell you directly under GDPR.

How do I tell if someone is using my identity?

Someone may be using your identity if you see activity you didn't start. Watch for:

Password reset emails or login alerts you didn't request
Your phone suddenly loses signal and shows "No service" or "SOS only"
Bills, credit checks or accounts you don't recognize
Friends getting odd messages or money requests "from you"
Debt collectors calling about debts that aren't yours

Losing signal for no reason is urgent: call your carrier from another phone straight away, because it can mean your number was swapped. A fake social profile using your name and photos is easier to spot when you know what's normally out there, which our guide to what the internet says about you helps with.

Where do I report identity theft or a data breach scam?

In the US, report identity theft at IdentityTheft.gov, which builds a recovery plan and the report you need for an extended seven-year fraud alert. Report online fraud to the FBI at ic3.gov.

UK: report fraud and cybercrime to Report Fraud, the service that replaced Action Fraud, at reportfraud.police.uk or 0300 123 2040. In Scotland, contact Police Scotland on 101. Forward scam texts to 7726.

EU: report fraud to your local police, and complain to your national data protection authority if a company mishandled your data.

If the leak exposed your home address or phone number on public sites, our guide to removing yourself from people search sites shows how to take it down.

The bottom line

Check every email you have used on Have I Been Pwned, review your saved passwords, and assume your phone number is out there. Then do the things that actually block criminals: unique passwords, passkeys or app-based two-factor, a carrier PIN, and a credit freeze in the US or Protective Registration in the UK.

Frequently asked questions

How do I check if my email has been leaked?

Enter it at haveibeenpwned.com. The free service lists every known breach your email appeared in and what data was exposed. Turn on Notify me to get alerts about future breaches, and check every email address you have used.

Is Have I Been Pwned safe to use?

Yes. It is a long-running free service run by security researcher Troy Hunt. Searching your email only shows which breaches include it. Its password checker never sends your actual password; it sends only part of a hash.

Can I check if my phone number was leaked?

Not reliably for free. If any breached account included your number, assume it is exposed. More scam texts, messages using your name, and unrequested one-time codes are common signs. Protect it with a carrier PIN or SIM lock.

What should I do first after a data breach?

Secure your main email account with a new unique password and two-factor authentication, then change any reused passwords. In the US, freeze your credit at Equifax, Experian and TransUnion. In the UK, consider Cifas Protective Registration.

Does a credit freeze hurt my credit score?

No. A credit freeze is free in the US, does not affect your score, and stays in place until you lift it. You can lift it temporarily at the bureau a lender uses when you apply for credit.

What is a SIM swap and how do I stop it?

A SIM swap is when a criminal convinces your carrier to move your number to their SIM card, so they get your calls and text codes. Stop it with a carrier PIN or number lock, and use an authenticator app or passkeys instead of SMS codes.

Sources

Figures are the latest published by each source when this guide was updated. Reported fraud losses are a floor: most fraud is never reported.

How to check if your email, phone number or passwords were leaked in a data breach