What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
An exposed email address does not, by itself, prove that anyone entered your mailbox or knows your password. It does mean criminals may use your address in more convincing phishing and password-reset scams. Your first job is to determine exactly what the breach included. Change any exposed or reused password immediately, secure important accounts with multi-factor authentication (MFA), and investigate your mailbox only if you see signs of takeover.
Use the breached company’s established website or a phone number you already trust to verify the notice. Do not use links or phone numbers supplied in an unexpected breach message. In the United States, the Federal Trade Commission (FTC) directs people whose sensitive information may be involved to IdentityTheft.gov/databreach guidance.
First, identify what was exposed
A breach notification can cover very different data. Read the notice and look for the specific categories involved:
- Email address only: Expect more credible-looking phishing, fake password resets and impersonation attempts. This is not evidence that your password or mailbox was accessed.
- Password or password hash: Change the password on the affected service promptly, then change it anywhere you reused it or a close variation. Treat the old credential as compromised.
- Phone number: Be alert for account-recovery scams and unexpected requests to move your number or provide a code.
- Financial information or government identifiers: Follow the FTC’s data-breach recovery guidance; additional identity-protection steps may be appropriate.
- Unknown or vague categories: Contact the organization through a trusted channel and ask which fields were included, when the exposure occurred and what protection it is offering.
The response depends on the data, not merely on the word “breach.” A company’s notice reports exposure of data from its systems; it does not automatically report a takeover of your email account.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What to do in the first hour
1. Verify the notification safely
- Open the company’s website by typing its known address yourself or by using a bookmark you created previously.
- Sign in through that normal route and look for a security or breach message. If you need help, use a phone number printed on a bill, card or earlier statement, not the number in the unexpected message.
- Record the affected service, the date of the incident if stated, the data categories and any deadline for accepting free monitoring.
Unexpected links, attachments and QR codes can lead to a second scam that uses the breach as a pretext. A legitimate notification does not require you to disclose a one-time authentication code to a caller or reply to an unsolicited message.
2. Change exposed and reused passwords
If the notice says a password was exposed, change it on that service right away. Then search your password manager, browser vault or memory for every account that used the same password or a similar pattern. Change those accounts to different credentials as well. The FTC’s password guidance says: “If a company or website tells you it lost your password in a data breach, change your password right away.” See Creating Strong Passwords and Other Ways To Protect Your Accounts.
Use a long, unique password for every important account. A password manager can generate and store unique credentials so you do not have to invent or remember each one. Do not “change” an old password by adding one digit or punctuation mark; a similar credential can still be guessed or recognized from another breach.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
If only your address was exposed, changing your email password is still sensible if it is old, reused or not protected by MFA, but the breach notice alone does not establish that the password was stolen.
3. Turn on MFA, starting with email
Enable MFA on your email account first, then on banking, payment, healthcare, workplace, cloud-storage and social accounts. CISA’s Turn On MFA guide recommends checking important accounts for this setting. The FTC explains that an authenticator app or a hardware security key is more secure than a code sent by text or email when the service supports those methods; its overview is Use Two-Factor Authentication To Protect Your Accounts.
Available methods vary by provider. A FIDO-compatible security key is an optional alternative if your provider supports it. Whichever method you use, never read an authentication code to an unexpected caller or type it into a page reached from an unsolicited message.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
How to tell whether your mailbox was actually taken over
An address-only exposure and a mailbox takeover require different responses. Look for evidence that someone signed in or changed your account:
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →- A login, password-reset or security alert you did not initiate.
- Unknown devices, locations or active sessions.
- A changed recovery email address, phone number or MFA method.
- Messages in Sent or Deleted that you did not write.
- New forwarding, filtering, delegation or “send as” rules you did not create.
- Inability to sign in even though your password previously worked.
- Contacts reporting unusual messages, money requests or links from your address.
A suspicious message in your inbox is not proof of compromise; it could be a spoofed address. Check account activity and settings directly with your provider.
If you can still sign in
- Open the provider’s security page and sign out of every other device or session. Sign back in only on devices you recognize.
- Change the password to a new, unique one and confirm that MFA is enabled.
- Review recovery email addresses, phone numbers, trusted devices, app passwords and connected applications. Remove anything unfamiliar.
- Inspect forwarding, filter, delegation and automatic-reply rules. Delete rules you did not create; attackers sometimes hide alerts or copy incoming mail.
- Check Sent, Deleted, Archive and Trash folders for unauthorized messages. Preserve evidence such as alert emails, dates and unfamiliar IP or device details before deleting it.
- Tell contacts that messages or requests for money from the account may be fraudulent. Ask them not to click links or send payments.
If you are locked out
Use only your email provider’s official account-recovery process. Start from its typed-in website or a previously saved help page, not a search-ad link or a message promising “recovery.” The FTC’s How To Recover Your Hacked Email or Social Media Account explains the general process. Have the original recovery details, approximate account-creation information and trusted devices available if the provider requests them. After regaining access, repeat the session, recovery-detail and forwarding-rule checks above.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Recognize and block follow-up phishing
Knowing your address can make a scammer’s story more plausible, but the reviewed official guidance does not provide a probability that any particular person will receive a phishing message. Treat every unexpected breach-themed email, text, call and social-media message as untrusted until independently verified.
- Do not click an unexpected password-reset link, open an attachment or scan a QR code.
- Do not reply with your password, date of birth, payment details or verification code.
- Check the sender and destination carefully, but do not rely on a familiar-looking display name.
- Reach the company through an address or phone number you already know is genuine. Type the address yourself rather than following the message.
- If a caller creates urgency, hang up and call the organization back using its published number.
Attackers may know the breached company, your address and a plausible date, yet still have no access to your mailbox. That information can be enough to make a fraudulent message look authentic.
When to freeze credit or seek identity-theft help
Escalate beyond ordinary password hygiene when the breach includes Social Security numbers, identity documents, financial-account information or other sensitive identifiers, or when you see unauthorized accounts or transactions. U.S. readers can use IdentityTheft.gov/databreach for tailored steps.
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
The FTC says a credit freeze or fraud alert can make it harder for an identity thief to open new accounts in your name. A freeze generally requires contacting each major credit bureau; a fraud alert can be placed through one bureau, which notifies the others. Follow the current instructions supplied by the bureaus and keep confirmation numbers.
Check whether the breached organization offers free credit monitoring or identity-theft insurance, and enroll only through a verified channel. Such services can alert you to some activity, but they do not replace changing exposed passwords, enabling MFA or recovering a compromised mailbox. Paid monitoring is optional; the FTC’s recovery guidance should come first.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Choose the response by the situation
| Situation | Priority actions | What it does not prove |
|---|---|---|
| Email address only | Expect targeted phishing; secure email with a unique password and MFA; verify future notices independently. | It does not prove your password or mailbox was accessed. |
| Password exposed | Change it on the affected service and everywhere reused; enable MFA. | Changing it does not remove copies of your email address from criminals’ lists. |
| Unknown login or changed recovery details | Sign out other sessions, restore recovery settings, remove forwarding rules and follow provider recovery steps. | A breach notice alone is not evidence of this activity. |
| Sensitive identity or financial data exposed | Use IdentityTheft.gov/databreach; consider a credit freeze or fraud alert and any verified free protection. | Monitoring does not secure your online accounts. |
Common mistakes that make the situation worse
- Using the breach email’s button: A real incident can be used to deliver a fake login page. Navigate independently.
- Changing only the breached account: Reused credentials leave other accounts exposed.
- Relying on text-message codes when stronger MFA is available: Choose an authenticator app or security key where the provider supports it.
- Ignoring email-account security: Email is often the reset channel for other accounts, so it deserves the earliest attention.
- Deleting evidence immediately: Save alerts, suspicious messages and activity details before cleaning up.
- Sharing a code with “support”: Anyone who initiated contact and asks for a one-time code is not entitled to it.
- Assuming a monitoring subscription fixes the breach: Alerts cannot undo an exposed password or remove an attacker already signed in.
A practical checklist
- Verify the notification through the organization’s known website or phone number.
- Write down every data category the notice lists.
- Change the exposed password and every reused or similar password.
- Use unique credentials, preferably generated and stored by a password manager.
- Enable MFA on email, financial and other high-value accounts.
- Review email sessions, recovery details, connected apps and forwarding rules if takeover is possible.
- Warn contacts if unauthorized messages were sent.
- Ignore unsolicited links, attachments, calls and requests for codes.
- Use IdentityTheft.gov/databreach and consider a credit freeze or fraud alert when sensitive identity data or fraud is involved.
- Accept legitimate free monitoring offered by the breached organization, while continuing the account-security steps above.
Frequently asked questions
Does an exposed email address mean my email was hacked?
No. It shows that the address was included in data exposed from a service. Look for unknown logins, changed recovery details, unauthorized messages or forwarding rules before treating the mailbox as taken over.
Should I change my email password if the breach listed only my address?
Change it if it is reused, weak or not protected by MFA. The address-only notice does not establish that the password was stolen, but securing email protects the reset channel for other accounts.
Is a credit freeze necessary after every breach?
No. It is most relevant when government identifiers or financial information were exposed, or when identity theft is suspected. U.S. readers should use IdentityTheft.gov/databreach for situation-specific guidance.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
