Guide

Were You Part of a Recent Data Breach? Here's How to Check

If your personal information was exposed in a data breach, there are concrete steps you can take-starting with finding out whether it happened in the first place.

Plain English · ~6 min read · Not legal advice

How to Find Out if Your Data Was Breached

Data breaches happen when hackers access companies' systems and steal personal information-like names, emails, passwords, or financial details. The good news: companies are required to notify you if your data was compromised. The challenge: keeping track of all those notifications.

Check for Breach Notification Letters or Emails

This is the most direct signal. By law, companies must notify customers if their personal information was exposed. Look for:

Official emails from the company (check spam folders too)
Physical letters from the company's legal department or a data breach notification service
Dates when notification was sent-these often include deadlines for next steps

If you find a breach notification, the letter or email should explain what information was exposed and what the company is doing about it. Read it carefully-many notifications outline free monitoring services or settlement opportunities you may be eligible to claim.

Check the Company's Official Notice Page

Some companies post breach information on their website, typically under "Security," "Privacy," or "News." If you use a service where you suspect your data may have been exposed, visit their official site directly and search for:

"Data breach" or "security incident"
Your state's name (companies often list which states were affected)
The company's official legal notice or press release

Be careful to go directly to the company's domain-don't click links in unsolicited emails, as those may be scams.

Use a Free Breach-Lookup Tool

Reputable, free tools let you check whether your email or username appears in known data breaches. The most trusted is Have I Been Pwned (haveibeenpwned.com), run by security researcher Troy Hunt. It's completely free and doesn't require you to sign up:

Enter your email address
The tool shows which breaches include your email (if any)
For each breach, you'll see what data was stolen and when it happened

Other reputable tools include Firefox Monitor and Ctrl+Z, but Have I Been Pwned is the most comprehensive and widely trusted. Never pay for breach-checking tools-legitimate ones are free.

Watch Your Credit and Identity

If a breach involves sensitive information like your Social Security number or financial account details, monitor your accounts and credit closely:

Check your credit reports at annualcreditreport.com (free, once per year from each bureau-Equifax, Experian, TransUnion). Look for accounts you didn't open.
Set up fraud alerts by contacting one of the three credit bureaus. They'll notify the others. This makes it harder for thieves to open accounts in your name.
Monitor your bank and credit card statements for unauthorized charges.
Use free credit monitoring services offered by many companies after breaches.

If you were in a data breach, you may be eligible for a settlement or refund. Find out if money is waiting in your name-at no cost.

Find My Pending Money

What to Do After You Confirm a Breach

Change Your Password

If your password was exposed, change it immediately-especially if you use the same password on other accounts. Create a strong, unique password (16+ characters, mix of letters, numbers, and symbols). If you're struggling to remember passwords, use a password manager like Bitwarden, 1Password, or LastPass.

Freeze Your Credit (Optional but Recommended)

A credit freeze prevents anyone-including you-from opening new accounts in your name without unfreezing first. If a breach involved your Social Security number or financial data, this is one of the strongest protections. You can freeze your credit for free at each of the three major credit bureaus: Equifax, Experian, and TransUnion. You can also unfreeze it when you need to apply for credit.

Enable Two-Factor Authentication

Two-factor authentication (2FA) adds a second step when you log in-usually a code sent to your phone. Even if your password is stolen, a hacker can't access your account without that second code. Enable 2FA on any account that offers it, starting with email, banking, and social media.

Check for Data Breach Settlements

Many companies settle breach lawsuits by offering free monitoring, cash payouts, or account credit to affected customers. These settlements are public and free to file yourself-you don't need a lawyer. You may be eligible to claim even if you didn't actively participate in the lawsuit. Many people miss these claims because they don't know they exist.

A word of caution on SSN requests: Never share your full Social Security number to "verify your identity" in response to a breach notification email or call. If a company genuinely needs to verify you, they'll ask for the last four digits only, or they'll verify you using information only you would know (like past addresses). Scammers often pose as breach-notification companies to steal SSNs.

The Takeaway

Finding out your data was breached is unsettling, but it's not the end of the story. Start by checking for official notifications, using a free tool like Have I Been Pwned, and monitoring your accounts. Then take concrete steps-change your password, enable 2FA, and consider freezing your credit. Many breaches also come with settlement opportunities waiting to be claimed. Stay calm, stay informed, and take action.

Eligibility and payouts are not guaranteed. PendingMoney is not a law firm and does not provide legal advice.