My password is in a data breach: what to do now

1What the count means

The number is how many times this exact password appears in the Pwned Passwords list, built from known data breaches [1]. It counts the password, not you. Someone else may have chosen the same one, so it does not prove that your account was hacked. To see whether your own email address is in a breach, use the search on Have I Been Pwned.

It still matters. Have I Been Pwned describes attackers who "automate login attempts using leaked credentials from other sites" [1]. A password on the list is one they can try. NIST says a site must force a change when there is evidence that a password has been compromised [2], and Australia's ACSC says to change a password if you think it has been compromised [3].

2What to do, in order

1. Your email first. Password resets for your other accounts go there, so anyone who controls it can reach them.
2. Banking, then anything that holds your card details.
3. Every other site that uses the same password. Australia's ACSC explains why: if you reuse a password, "all those accounts are at risk" [3].
4. Turn on multi-factor login where you can, starting with your email. A leaked password alone is then not enough. CERT-In in India also asks for this [4].
5. Look at recent logins in your email and bank account settings for anything you do not recognise. If you find something, contact that company directly.

Do not make a small change to the old password, such as a new number at the end. Have I Been Pwned warns that attackers can predict such patterns [1].

3Stop one leak reaching everything

You can lower the damage of a later breach, though you cannot stop a company from being breached. The fix is a different password on every site. Nobody can remember that many, so official bodies in Australia, New Zealand, Canada and the UK all mention a password manager [3] [5] [6] [7].

If your own account was in a breach, your name, email or phone number may have been in it too, and data brokers sell the same kind of details. You cannot pull back what has leaked, but you can shrink what is out there.

4If your password was not found

That is a good sign, but only a limited one. The list holds passwords from breaches that are known and published. A password stolen but not yet published cannot be on it.

Sources

1. [1]Have I Been Pwned, Pwned Passwords. Read the source. Read 30 October 2026.
2. [2]NIST, SP 800-63B-4, section 3.1.1 (United States). Read the source. Read 30 October 2026.
3. [3]ASD's ACSC, Personal cyber security handbook, published 7 October 2026 (Australia). Read the source. Read 30 October 2026.
4. [4]CERT-In and Cyber Swachhta Kendra, Internet Safety Awareness Booklet for Digital Nagriks and Digital Enterprises, Safer Internet Day 2024 (India). Read the source. Read 30 October 2026.
5. [5]Own Your Online, Keep your data safe with a password manager (New Zealand). Read the source. Read 30 October 2026.
6. [6]Get Cyber Safe, Passphrases, passwords and PINs (Canada). Read the source. Read 30 October 2026.
7. [7]National Cyber Security Centre, Three random words, published 21 December 2021 (United Kingdom). Read the source. Read 30 October 2026.