You open your inbox, see a message from a service you barely remember signing up for, and the word breach jumps off the screen. Or worse, a push notification or a news alert about a cyberattack lands first and you have no idea whether your account was inside the blast radius. The good news is that the diagnosis takes about five minutes and the response has a clear order of operations. The bad news is that the long tail of a leak — identity documents, bank details, your email address itself — demands vigilance for months, not hours.
- Check first, panic later: a free breach lookup tells you which known incidents include your address, and built-in password managers at Google and Apple tell you which specific credentials are circulating.
- Minutes versus months: a leaked password is a five-minute fix; a leaked national ID or bank account number is a monitoring project.
- Order matters: rotate the compromised password and its near-duplicates, then harden the email account, then call the bank.
- You have legal leverage: if a company failed to notify you under the GDPR, a complaint to the data protection authority is a real pressure point.
Free breach checkers: what they see and what they miss
The fastest route is typing your email address into Have I Been Pwned, a free breach index that Spain’s national cybersecurity institute, INCIBE, explicitly recommends. It returns the known incidents in which your address appears. Security researcher Troy Hunt built the service in 2013 and has maintained it ever since, starting after the Adobe customer-account leak — at the time the largest known exposure of its kind — because he kept finding the same accounts, frequently with the same password, in breach after breach. As of 17 October 2026, its counter lists 1,045 breached sites and more than 17.8 billion email addresses.
Three caveats are worth internalising. First, the service does not store passwords alongside addresses: its separate Pwned Passwords tool checks credentials in isolation, hashed with SHA-1 and anonymised before transmission — an approach password manager 1Password already adopted in 2018 to warn users about compromised keys. Second, a clean result is not a clean bill of health; the project’s own maintainers describe the database as covering only “a small part” of everything that has leaked, since many breaches are never published and some are never detected. Third, you can subscribe to Notify Me and receive an email the moment your address turns up in a new incident.
Google and Apple catch the passwords, not just the address
A breach directory tells you where your address appears. The password managers baked into Android, Chrome, iOS and macOS tell you which credentials of yours are actually circulating — a materially different question.
On the Google side the feature is Password Checkup, reachable from the browser via the password manager or directly at passwords.google.com. It sorts findings into three buckets: exposed, weak and reused passwords. Automatic alerts are switched on in the manager’s settings. Google’s own advice is worth repeating: if a message claims your password leaked, navigate to Password Checkup yourself rather than clicking the link in the email.
On Apple hardware, the Passwords app surfaces weak or leaked credentials in its Security section on macOS. On iPhone running iOS 17 or earlier, the path is Settings > Passwords > Security Recommendations, where “Detect Compromised Passwords” can be enabled; from iOS 18 onward, credentials live in the dedicated Passwords app. Apple’s technical documentation states that the check shares at most a 15-bit prefix of each password’s hash with its servers.
The first hour: passwords first, inbox second, bank third
Treat every piece of data you handed to the breached company as compromised. Then work in this sequence.
- Rotate the affected password and every account that reused it or a close variant. INCIBE stresses long passphrases mixing letters, digits and symbols, and never recycling them across services. If memorising them is the obstacle, this is the moment to adopt a password manager that generates and stores unique keys.
- Secure the email account, because everything else resets through it. Unfamiliar sessions, changed recovery options or missing messages warrant a full account audit.
-
Call the bank if financial data was involved. INCIBE’s guidance is blunt about the escalation path:
Cancel the bank card and identify any suspicious activity.
- Assume the follow-up is a phishing attempt. Breaches are followed by emails, SMS and calls that quote your real details to look legitimate. Do not engage with unsolicited messages; INCIBE’s free helpline on 017 handles doubts.
Long-tail damage: national ID and bank account numbers
A password can be replaced today. Your national identity number accompanies you for life, which is why the playbook differs. Combined with your name and address, a stolen ID number enables impersonation. INCIBE recommends egosurfing — searching your own details online — to spot published data, exercising the right to erasure before the AEPD if it appears, and filing a report with the Policía or Guardia Civil over any fraudulent attempt.
With a leaked IBAN, the scenario that matters most is an unauthorised direct debit. The Banco de España reminds consumers that where no authorisation was given, the window to return a charge is 13 months. Reviewing statements weekly for a while after such a leak is not paranoia; it is basic maintenance.
If the notification never arrives, GDPR gives you leverage
Article 34 of the GDPR obliges an organisation to inform affected individuals “without undue delay” when a breach is likely to pose a high risk to their rights. Article 33 separately requires notification to the supervisory authority within 72 hours of becoming aware, unless the risk is unlikely — and any delay must be justified. The notice to users must be in clear and plain language, include a contact point and describe the measures taken. Encrypted data can exempt an organisation from informing the public.
Where no warning came and you believe one was due, a complaint goes to the AEPD’s electronic office with evidence or at least indicators. The agency has up to 3 months to decide on admission, and compensation for damages is claimed from the company, not the regulator. This is not a symbolic gesture: in 2025, sanctioning or warning proceedings linked to breaches rose from 30 to 77, and fines on that basis totalled €19,836,603 — 40% of all penalties issued that year.
The uncomfortable structural truth is that the burden falls on the person whose data leaked rather than the organisation that lost it. That asymmetry is precisely why filing complaints when notifications never materialise matters beyond the individual case: it is one of the few sustained pressures pushing companies to take Article 34 seriously. If you do only one thing today, enable alerts in Have I Been Pwned and in your password manager. You will not prevent the next breach, but you will at least stop being the last to know.