Your Email Is in a Data Breach: A Teen's Calm Action Plan

You open your inbox and see a message: "Your account may have been part of a data breach." Your stomach drops. Is it real? Has someone hacked you? What now?

Breaches are common, and most of the time they are not your fault. What matters is what you do next. This guide walks you through it without panic.

What a data breach actually is

A data breach happens when a company or service is hacked, or accidentally exposes information it was storing. Depending on the service, the leaked data can include email addresses, usernames, phone numbers, or passwords. Good services store passwords in scrambled form, but weak scrambling can sometimes be cracked.

A breach does not automatically mean someone is inside your accounts. It means some of your information is out there and could be used against you, especially if you reuse passwords.

Step 1: Check if the alert is real

Scammers love fake breach warnings because they create panic. Before you click anything:

• Do not tap links in the message. Open the app or type the website address yourself.
• Look for pressure words like "act now" or "account will be closed."
• Check your account's security page for real notices.
• Be suspicious of anyone asking for your password or a login code. Real companies never do.

Step 2: See where your email has appeared

Have I Been Pwned (haveibeenpwned.com) is a well-known free service, created by security researcher Troy Hunt, that lets you enter an email address and see which known breaches included it. You never need to enter a password there. If your email appears, note which service was affected and when.

Step 3: Change the password, then every place you reused it

This is the most important step. Attackers often try a leaked password on other sites, including email, gaming, and social media. This is called credential stuffing.

1. Change the password on the breached service first.
2. Think about where else you used the same or a similar password. Change those too, starting with your email, since it can reset everything else.
3. Make each new password long and unique. A passphrase of several random words works well.
4. Save them in a password manager so you don't have to remember them all.

Step 4: Turn on two-factor authentication

Even if someone has your password, two-factor authentication (2FA) can stop them from getting in. Use an authenticator app or a passkey where possible, because text message codes are better than nothing but easier to attack. Start with your email, then gaming, social media, and shopping accounts.

Step 5: Watch for follow-up scams

After a breach, criminals may use leaked details to make messages look convincing. Expect:

• Phishing texts or emails that mention a real service you use.
• "Support" messages offering to fix your account for a fee or a code.
• Friend requests or DMs from strangers who seem to know a little about you.

If a message knows something about you, that doesn't make it trustworthy. Always go to the official app or site yourself.

Step 6: Check your account for signs of trouble

• Look at recent login activity and signed-in devices, and log out any you don't recognize.
• Check recovery email and phone number settings. Attackers sometimes change them.
• Look for unfamiliar purchases, messages you didn't send, or changed profile details.

If you lost access, use the service's official recovery page and tell a trusted adult. If money or personal documents are involved, an adult can help contact the bank or the right authorities.

Learn more from trusted sources

Videos: We don't link to specific videos here because links can change or disappear. Search YouTube for "Secure Our World" from CISA, or for beginner password and 2FA explainers from National Cybersecurity Alliance (Stay Safe Online). Choose videos from official organizations, and check the channel name and date before trusting advice.

Reports and guides: The Stay Safe Online website (staysafeonline.org) and CISA's Secure Our World pages (cisa.gov/secure-our-world) publish free guides and tip sheets on passwords, 2FA, phishing, and updates. Many are available as downloadable PDFs. Download them only from the official site address you typed yourself.

The bottom line

A breach alert is a signal to tidy up your security, not a disaster. Check the alert is genuine, change reused passwords, turn on 2FA, and stay alert for scams that follow. Do those four things and you will be much harder to hack than most people online.