What to Do When a Site Says Your Password Was Leaked
Your browser, phone or a website says your password appeared in a data leak. What the warning means, how to check it is genuine, and exactly what to change.
A pop-up in your browser or phone says: "A data breach on a site or app exposed your password. Change it now." It is alarming, but it is also useful. It means your password is on a list criminals use, and you have the chance to change it before anyone uses it.
What the warning means
Browsers, phones and password managers compare your saved passwords (securely, without revealing them) against collections of passwords leaked in known breaches. A warning means that password, and possibly your username, has appeared in one of those leaks. It does not necessarily mean the account has been broken into, but attackers use these lists to try logins everywhere. See credential stuffing explained.
First, check the warning is genuine
- Genuine: a notice inside your browser's password settings, your phone's password settings, or your password manager app.
- Be cautious: emails, texts or web pop-ups saying your passwords leaked, especially with a link to "secure" your account or a phone number to call.
If in doubt, ignore the message and open your browser or password manager's security check yourself.
What to do, in order
- Change the leaked password on the account the warning names, using a new, unique password.
- Change it everywhere else you used it, starting with your email, then banking, mobile money and social media.
- Turn on two-step verification for those accounts.
- Check for signs of misuse: recent sign-ins, changed recovery details, forwarding rules in email, unfamiliar payments. See signs your email has been hacked.
- Run a full password check for other reused or weak passwords.
If you reused this password on your email, change the email password first. Email controls password resets for everything else.
Stop it happening again
- Use a password manager to create unique passwords for every account. See how to set up a password manager.
- Keep leak warnings switched on in your browser or password manager.
- Check your email address in a breach-checking service. See how to check if your details were in a breach.
If you think someone already got in
Follow our step-by-step guide, your first hour after an account takeover.
Received an email about a leaked password? Paste it into CyberWatch AI Scan for a free check before clicking anything.
For more, read our complete guide to identity theft and account security.
Frequently asked questions
Does a leaked password warning mean I have been hacked?
Not necessarily. It means that password appeared in a known data breach somewhere. Anyone could try it, so change it anywhere you used it.
Is the warning from my browser genuine?
Warnings that appear inside your browser's or phone's own password settings are genuine. Be cautious with emails or pop-ups claiming your passwords leaked that ask you to click a link or call a number.
Do I need to change all my passwords?
Change the leaked password on every account where you used it, starting with email and banking. If you reused one password widely, this is the moment to move to unique passwords.
Sources
- Have I Been Pwned, Troy Hunt
- Creating Strong Passwords and Other Ways To Protect Your Accounts, US Federal Trade Commission
- Recovering a hacked account, UK National Cyber Security Centre
