Password Found in a Data Breach? Check and Fix It

Chrome, your iPhone or Facebook has just told you a password you use was found in a data breach. Or a breach checker listed your email against websites you barely remember joining.

The short answer: this is a warning, not a break-in. Somewhere, a website you signed up to lost its user data, and your email or password ended up in a published list. Change that password everywhere you used it, starting with your email account, then add a second sign-in step so the old password is useless on its own.

This guide explains each alert, how to check your own details safely, what to change first, and the fake "your data was leaked" messages to ignore.

Last checked: 29 September 2026.

#What Does "Your Password Was Found in a Data Breach" Mean?

It means a password saved in your browser or phone matches one that has been published online after a breach, usually of some other website or app. Google's Password Checkup page says compromised password and username combinations are unsafe because they have been published online, and recommends changing them as soon as you can. The alert does not mean Google, Apple or Meta was hacked, and it does not prove anyone has logged in. The risk is reuse: if one password opens your email, Instagram and banking, one leak opens all three.

#Which Alert Did You Get?

Several tools raise breach alerts, and they check slightly different things. Match yours below. The wording on your screen can vary by app version, language and region, so go by the key words.

#Is the Alert Real or a Scam?

The alerts in the table appear inside the app or browser you already use, not as an email asking you to click. Google's Password Checkup page says to go directly to Password Checkup to confirm a notification is authentic.

• Real: a prompt inside Chrome, the Passwords screen on your iPhone, or a Facebook prompt after you log in normally.
• Suspicious: an email, SMS or WhatsApp message saying your data was leaked, with a link to "secure" or "verify" your account.
• Scam: any page that asks for your current password, a login code or your bank details so it can "check" or "protect" you.

Google's phishing guidance is blunt: if you click a link and are asked for the password to your Google Account or another service, do not enter it; go directly to the website instead. It also notes that Gmail will never ask for your password by email. If you already typed a password into a page like that, our guide on what to do after clicking a phishing link covers the next steps.

#How to Check Whether Your Own Details Were Exposed

You only need to check your own email addresses and your own saved passwords. You never need leaked files for this, and you should never download or buy a so-called breach database. It is other people's stolen data, and you gain nothing from it that the checks below do not already tell you.

Whether you searched "semak emel bocor" or "密码泄露 怎么查", the checks are the same. Start with the passwords you already save, because those checks never ask you to type a password.

1. Google Password Checkup: in Chrome on a computer, open the menu, choose "Passwords and autofill", then "Google Password Manager" and "Checkup". Outside Chrome, go to passwords.google.com and choose "Go to Password Checkup". Google's page says it shows passwords that are exposed, weak or used in multiple accounts.
2. iPhone or iPad: on iOS 17 or earlier, go to Settings, Passwords, Security Recommendations, and turn on "Detect Compromised Passwords". Apple's password security page says passwords are then marked as leaked, reused or weak. On iOS 18 and later, passwords live in the Passwords app.

Then check your email address. Have I Been Pwned is a free service that tells you which known breaches included an address you type in. Its FAQ says no passwords are loaded alongside the email addresses, and that it can only return results for one address at a time. Type the address into the site yourself rather than following a link someone sent you.

• Check each email you have used for sign-ups, including old Yahoo, Hotmail or work addresses.
• Sign up for its notifications to hear about future breaches. The FAQ says alerts come from noreply@haveibeenpwned.com and go only to the address being monitored.
• Some breaches are marked sensitive and only show after you prove you own the address.

The same site runs a Pwned Passwords check, which it says hashes your password on your device and sends only a fragment. That design is unusual. As a rule, never type a real password into a website that offers to check it; use the checkups built into your browser or phone.

#What to Change First: A Priority Order

Change passwords in order of what each account can reset. Your email inbox comes first because every "Forgot password" link lands there. Whoever controls it can take the rest.

1. Your main email account (Gmail, Outlook, Yahoo). Set a new password you use nowhere else, then check its recovery phone, recovery email and forwarding rules for anything you did not add.
2. Any account that used the exact leaked password, whether or not it was the breached site.
3. Online banking, e-wallets and shopping accounts with saved cards, if they shared a password with anything else.
4. Social media: Instagram, Facebook, TikTok and X, plus any email address linked to them.
5. Work accounts. Tell your IT team if a work password was reused on a breached site.
6. Everything else, as you log in. A password manager can generate a unique password for each.

Chrome's password help page describes a "Change it for me" option on compatible websites. If it fails, choose "Change it on the site" and do it by hand.

If Facebook stopped you at login, go along with it. Its page on why it asks you to change your password says it checks lists of passwords stolen from other websites and, on a match, guides you through a change at your next login.

#Add a Second Step So a Leaked Password Is Not Enough

A new password fixes today's leak. A second sign-in step protects you from the next one. Google's page on 2-Step Verification describes it as an extra layer of security in case your password is stolen.

One detail people miss: Google's passkey page says adding a passkey does not change or remove any existing sign-in or recovery methods. An old recovery phone or email someone else controls still works, so check those separately. Only create passkeys on devices you own, because anyone who can unlock that device can open your account.

SMS codes follow your SIM. If your phone suddenly shows "No service" and codes stop arriving, call your Malaysian carrier from another phone and ask whether the SIM was replaced. For Instagram, Facebook and TikTok, our walkthrough of two-factor authentication on each platform shows where the options are.

#Signs the Leak Has Already Been Used

Most alerts arrive before anyone uses the password. These signs mean someone got there first:

• Login alerts or "new sign-in" emails from places or devices you do not recognise.
• Emails saying your recovery email, phone number or password was changed.
• Posts, messages or purchases you did not make.
• Password resets you did not request arriving in your inbox.

If you see any of these, you have moved from prevention to response. Our guide to spotting someone else logged into your account explains how to sign out unknown sessions, and if the inbox itself is gone, see recovering a hacked Gmail account.

#Mistakes That Leave You Exposed After a Breach

• Changing the password only on the breached site, and leaving the same password on your email.
• Adding a number or symbol to the old password. Have I Been Pwned warns that attackers can predict common patterns even when a password is slightly modified.
• Dismissing the alert. Google lets you dismiss a compromised password warning, but the password is still published.
• Clicking "secure your account" in an email instead of opening the app yourself.
• Typing a password into a stranger's "leak checker" site, or downloading leaked files to see what was taken.

#Malaysia: Breach Notices, Scams and Where to Report

The Personal Data Protection Commissioner's guideline on data breach notification says an organisation must tell affected people when a breach is likely to cause significant harm, no later than seven days after notifying the Commissioner, and explain the steps they can take. If you get such a notice, verify it on the company's own website, then act on it.

If a leaked password led to money leaving your account, call your bank and the National Scam Response Centre on 997 straight away. The government's NSRC 997 page asks victims to call within 24 hours of discovering a scam so authorities can try to block the transactions, to contact their bank, and to lodge a police report at the nearest police station.

A phishing site posing as a breach alert, or a hacked account, can be reported to CyberSecurity Malaysia's Cyber999 centre, the national point of contact for computer security incidents.

#When a Security Review Makes Sense

Most people can handle a breach alert alone with the steps above. A second pair of eyes helps when the leaked password guarded a business account or Page, when a leak has already turned into a takeover, or when you are unsure which recovery details are still yours. AwareXone, AwareXone's recovery and digital identity service, reviews your situation first and tells you plainly whether you need help at all. We cannot remove your data from a breach, and nobody can. You can read how our account security service works, and our Trust Center sets out what we will never ask for, starting with your passwords and codes.

#Frequently Asked Questions