Guide
Got a data breach email? What to do next
The email usually starts with "We are writing to let you know about a security incident". It is easy to archive and forget. Do not. A breach notice tells you exactly which piece of your identity is now in someone else's hands, and the next twenty minutes decide whether it stays a non-event.
First, make sure the email is real
Breach notices are a favourite disguise for phishing. Before you click anything:
- Check the sender's domain. It should match the service, not a lookalike.
- Do not use the links in the email. Open the service's website yourself, or search for the incident in the news.
- A real notice never asks for your password or card number by email.
Then, act on what was exposed
- Password (even hashed): change it on that service now, and on every other service where you used the same one. This second part is the one that matters most.
- Email address only: expect more phishing. Be suspicious of emails that mention the service by name in the coming months.
- Postal address or phone number: watch for targeted scams by letter, text message or phone call that quote your real details.
- Payment card: check your statements, and ask your bank for a new card if the full number was exposed.
Wherever the service offers it, turn on two-factor authentication. It makes a leaked password useless on its own.
The part most people skip: the other accounts
If you reused that password, the breached service is not the problem. Every account that shares it is. The difficulty is remembering them all. Your inbox helps here too: search Gmail for subject:(welcome OR "verify your email") to list sign-ups, and for subject:("security incident" OR "data breach" OR "unauthorized access") to find older notices you may have missed.
HealthInbox does this pass automatically. It lists every service tied to your address from your email headers, and puts the ones that sent you a breach or security notice at the top, with what to do for each.
Should you delete the account?
If you no longer use the service, yes. An account you do not use can only hurt you in the next breach. Our guide on deleting old online accounts covers how to do it, including the GDPR erasure request for services that hide the delete button.
A breach notice is a reminder of every account you forgot. HealthInbox shows them all, starting with the ones that reported an incident, without uploading a single email.
See how HealthInbox finds them