Free tools Windows power users keep installed
One-click scans. No signup required.
Do not assume that a breach notice means your email account was hacked. An exposed email address is an identifier; it does not prove that someone signed in. An exposed password is more urgent, especially if you reused it. First verify what information was involved through the company’s known website or app, then replace any exposed or reused password, secure your email account with multi-factor authentication (MFA), and investigate unfamiliar activity.
The right response depends on the fields exposed. A leaked email address calls for vigilance. A leaked password requires immediate replacement everywhere it was reused. A compromised email account requires recovery and a review of forwarding, recovery and sign-in settings. Social Security or financial information calls for additional identity-theft measures.
As an Amazon Associate I earn from qualifying purchases.
What a data-breach alert actually tells you
A breach notification usually says that information stored by a company was exposed, stolen or made accessible without authorization. It does not, by itself, show that an attacker used your credentials or entered your email account. Read the company’s notice for the exact data categories involved and the incident date, if provided.
Keep three events separate:
- Identifier exposure: your email address appears in compromised data. You may receive more phishing attempts, but exposure alone is not proof of account access.
- Credential exposure: a password, password hash or authentication token was included. Treat the password as unsafe, particularly if you used it elsewhere.
- Account takeover: someone actually signed in, changed settings or acted as you. This requires the recovery and investigation steps below.
A breach alert is also different from a suspicious-sign-in alert. For example, Google’s compromised-password warning directs users to open Password Checkup directly and confirm which credentials need changing, rather than following an unexpected message link.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Step 1: Verify the notice without handing over your credentials
- Do not click an unexpected “secure your account” link. Phishers often imitate breach notices. Open the affected service with a bookmark you already trust, a manually typed address, or its official app.
- Find the original company announcement. Check the service’s security or privacy page, your account notifications, or a statement sent through a channel you already know is genuine.
- Record exactly what was exposed. Note whether the notice names an email address, password, phone number, security questions, payment data, government identifier or authentication token. Also note whether the company says the data was encrypted, reset or only accessed internally.
- Check the account separately. Review recent sign-ins, devices, password changes and security alerts. An unfamiliar sign-in is evidence about account activity; the breach notice alone is not.
If you cannot verify the message, contact the company through contact details you locate independently. Never provide a password, one-time code or recovery code to someone who contacts you unexpectedly.
Step 2: Replace an exposed or reused password
Change the password on the breached service promptly. Then search every other account where you used the same password or a close variation. Attackers test leaked credentials against email, shopping, social, workplace and financial services in automated “credential-stuffing” attempts.
Use a genuinely new password
Do not turn the old password into a predictable variation by adding a number, punctuation mark or new year. Create a unique password for every account. A password manager can generate and store random passwords; a browser’s built-in password generator and vault can also do this. The tool matters less than preventing reuse and protecting the device or account that unlocks your vault.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Change passwords in the right order
- Change the password on the breached service.
- Change your primary email password if it was reused, similar, or potentially visible to the breached service.
- Change passwords for financial, work, health and cloud-storage accounts, prioritizing any that shared the exposed credential.
- Review saved passwords for the same or similar string and replace each match.
- Sign out other sessions where the service offers that control, then create new sessions with the replacement password.
If the service supports passkeys, an authenticator app or a security key, enroll one after changing the password. Keep an offline recovery code or another approved recovery method in a safe place.
Step 3: Secure your email account first
Your email account deserves priority because it receives password-reset links for many other services. Even when only another site’s password was exposed, make sure the email account has a unique password and MFA.
Turn on multi-factor authentication
MFA requires something in addition to the password, such as an authenticator code, a hardware security key or a device approval. A stolen password is less useful when the attacker cannot provide that second factor. CISA describes phishing-resistant MFA as the stronger approach where a service supports it.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
| Method | Security and practical considerations |
|---|---|
| Security key | Strong phishing resistance when supported. Confirm the account accepts the key and keep a registered backup or recovery method. |
| Authenticator app | Usually stronger than text messages and widely supported. Protect the phone, preserve transfer or backup instructions, and test recovery before replacing the device. |
| Text or email code | Better than a password alone and sometimes the only option. It is more exposed to number takeover, mailbox compromise and phishing, so use a stronger method when available. |
Choose a method you can reliably keep access to. An MFA method that leaves you permanently locked out after losing a phone is not a complete recovery plan.
Recommended Free Tools
Check recovery and forwarding settings
After signing in, verify the recovery email address and phone number. Remove any destination you do not recognize. Inspect forwarding rules, filters, delegates, connected apps and authorized devices; an attacker may silently forward password-reset messages while leaving the inbox apparently normal.
Review sent and deleted folders for messages you did not write, and check automatic replies, signatures and mailbox rules. If the account sent suspicious messages, warn contacts through another channel so they do not open links or attachments from the compromised mailbox.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How to tell whether your email account was hacked
Look for several signals rather than relying on one unfamiliar message. Possible takeover indicators include:
- Sign-ins from an unfamiliar location, device or time that you cannot explain.
- A password, recovery phone number or recovery email changed without your authorization.
- Repeated password-reset messages that you did not request.
- Messages in Sent or Deleted that you did not create.
- Unknown forwarding rules, filters, delegates, connected applications or mail clients.
- Contacts reporting suspicious messages from your address.
- Inability to sign in even though your previous password should work.
Travel, a new device, a mobile carrier gateway or a virtual private network can make a legitimate sign-in look unusual. Check the event’s device details and time before declaring a takeover, but treat unexplained password or recovery changes as urgent.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Step 4: Recover an account you can no longer access
Use the provider’s official account-recovery process from its known website or app. Do not use a recovery link supplied by an unexpected email, text or caller. If the attacker changed recovery details, the provider may ask for an older password, a previously used device, backup codes or other ownership evidence.
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- Start recovery from the provider’s normal sign-in page.
- Follow every verification step and provide information accurately; guessing can delay or block recovery.
- Once access returns, set a new unique password and enable MFA.
- Sign out all other sessions and revoke unfamiliar app access.
- Restore your own recovery contacts, remove forwarding and filters you did not create, and inspect sent and deleted mail.
- Repeat the password-reset process for important accounts whose reset links may have been exposed.
If recovery fails, use only support channels listed on the provider’s official site. Never pay someone who promises to “unlock” an account through an unofficial channel or asks for a verification code.
Step 5: Match the response to the exposed information
| Information named in the notice | Proportionate action |
|---|---|
| Email address only | Expect more targeted phishing, use unique passwords and MFA, and monitor sign-in alerts. An email-only exposure does not justify a credit freeze by itself. |
| Password or security answers | Change the credential on the affected service and everywhere it was reused or closely varied. Review sessions and MFA. |
| Phone number | Watch for unexpected SIM or carrier changes and prefer an authenticator app or security key where available. |
| Payment-card data | Contact the card issuer through the number on the card or an official statement, monitor transactions and follow its replacement advice. |
| Social Security number or comparable government identifier | Use the FTC’s tailored guidance at IdentityTheft.gov/databreach. Check credit reports and consider a credit freeze or fraud alert when appropriate. |
| Identity-theft or credit-monitoring service offered by the breached company | Consider enrolling after verifying the offer through the company’s known site. Read what the service covers and how long it lasts. |
A credit freeze restricts access to your credit file until you lift it; a fraud alert asks businesses to take extra steps to verify an applicant. The FTC says either can be appropriate when Social Security information is exposed. Neither is required merely because an email address appeared in a breach.
Defend against follow-up phishing
Once an address is known to attackers, messages may become more convincing. Be suspicious of urgent requests to confirm a password, approve an MFA prompt, download a “security tool” or pay a fee to restore an account.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →- Open the service by typing its address or using your saved app, not by tapping the message link.
- Inspect the destination domain before entering credentials; a familiar logo proves nothing.
- Never disclose one-time codes, backup codes or security-key prompts to a caller or message sender.
- Do not approve an MFA request you did not initiate. Repeated prompts can be an attempt to wear you down.
- Report fraudulent messages through your email provider and delete them after preserving evidence you may need.
Keep your operating system, browser and mail app updated. Updates do not undo a breach, but they reduce separate routes attackers may use after convincing you to open a malicious attachment or site.
A practical priority checklist
Use this order when time is limited:
- Verify the alert through a known channel and identify the exposed fields.
- Change the exposed password and every reused or similar password.
- Secure the primary email account with a unique password and the strongest available MFA.
- Review sign-ins, recovery details, forwarding, filters, connected apps, sent mail and deleted mail.
- Recover the account through the official process if you are locked out or settings changed.
- Contact financial institutions about exposed payment information and follow their instructions.
- For Social Security or other identity data, use IdentityTheft.gov/databreach and evaluate a fraud alert, freeze or monitoring offer.
- Continue watching account alerts and credit activity for follow-up misuse.
What not to conclude from a breach notice
Do not conclude that your email account was entered simply because its address appeared in a database. Do not conclude that changing one password is enough if you reused it elsewhere. Do not install an unrequested “cleanup” program, pay an unsolicited recovery service or send a verification code to someone who claims to represent the breached company. The notice identifies a risk; your sign-in history and account settings determine whether there is evidence of takeover.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
