My password was found in a data breach. What does that mean?
A website you used lost its records. The password you used there is now on lists that anyone can get. It does not mean your device was hacked. It means that password is no longer safe anywhere you use it. Change it on every account that shares it.
Last read from the sources at the foot of this page.
What does it mean for you?
Password checkers compare your saved passwords with lists from past breaches. Google says what a match means.
Compromised passwords and username combinations are unsafe because they've been published online.
Why does one breach put other accounts at risk?
People reuse passwords. Attackers take the pairs from one breach and try them on email, banking and shopping sites. NIST asks services to block passwords found in breach data for the same reason.
When processing a request to establish or change a password, verifiers SHALL compare the prospective secret against a blocklist that contains known commonly used, expected, or compromised passwords.
What should you do?
- Change the password on the account the warning names.
- Change it on every other account where you used the same password, starting with email.
- Turn on two-step sign-in where it is offered.
- Let a password manager make a new password for each account.
Where is the change made?
Each account named, in its own security or password settings. Your email account settings come first, because a reset link for every other account goes there.
What else do people ask about this?
Is the warning real?
A warning inside your own browser or password manager is real. An email warning could be phishing: open the password checker yourself rather than following a link.
Do I need to change it if the account is old?
Yes, if you used the same password anywhere else. If not, close the old account or change it anyway.
Where does this come from?
- Google Account Help, Change compromised passwords in your Google Accountsupport.google.comRead 16 October 2026
- NIST SP 800-63B, Digital Identity Guidelines: Authentication and Authenticator Managementpages.nist.govRead 16 October 2026
Is your email address in a public breach?
Enter one address. We look it up in monitored breach databases and show which breaches list it and what each exposed.