Was Your Email in a Data Breach? Check in 2 Minutes, Then Do This

Hacked companies leak millions of email addresses and passwords every year. You did nothing wrong, but if your address was in one of those leaks, someone may already be trying your old password on other sites. The good news: you can check in two minutes, for free, and fix the risky part in ten.

1. Check your email address

Open haveibeenpwned.com, a free service run by a security researcher since 2013, type your email address and press the button. It lists every known leak your address appeared in, which company it came from, when it happened and what leaked: only the email, or also passwords, phone numbers or home addresses.

Do it for every address you use, including the old one you no longer read. Old accounts are often the ones still using an old password.

What to do: write down each company and what leaked. "Passwords" next to a name is the line that matters most.

2. Check your saved passwords on iPhone

Your iPhone already watches for this. Open the Passwords app (on older versions of iOS: Settings > Passwords) and look at Security. It shows saved passwords that appeared in a known leak, passwords you use on more than one site, and passwords that are easy to guess. Make sure "Detect Compromised Passwords" is switched on in the Passwords settings.

If you save passwords in Google Chrome, the same check lives at passwords.google.com under Password Checkup.

3. Change the right passwords first

Not every leak is urgent. Work in this order:

Your main email account. Whoever controls your email can reset almost every other password you have.

Any account that used a leaked password, and every other site where you used that same password.

Banking, shopping and anything with a saved card.

Everything else, when you have time.

Give each account its own password. You do not need to remember them: let the iPhone suggest a strong password when you sign up or change one, and it will fill it in for you next time.

4. Add a second lock

A new password fixes today's leak. A second step at sign-in protects you from the next one, because a stolen password alone is no longer enough to get in. Turn it on for your email first, then your bank and your social accounts. We explain the best order in Two-Factor Authentication: The Order to Turn It On.

5. Expect the follow-up messages

After a big leak, criminals send emails and texts that mention the leak, the company's name or your real details to look believable: "Your account was compromised, confirm your password here." The company that leaked your data will not ask you for your password. Open the app or type the website address yourself instead of tapping the link. Our 30-second check is here: How to Spot a Phishing Message in 30 Seconds.

What a VPN changes, and what it does not

A VPN encrypts the connection between your device and the VPN server, so the owner of a café or hotel Wi-Fi cannot read what you type on the way out. It cannot stop a company from being hacked and losing the data you already gave it, and it does not change a password that has already leaked. Strong, different passwords and a second step at sign-in are what protect you there. Use all three and each covers a gap the others leave open.

---

CasperVPN encrypts your internet connection with WireGuard, OpenVPN, IKEv2 and CasperCloak, our own protocol, on iPhone and iPad (Mac app coming). Download CasperVPN →