Leakill • Security Intelligence • Public Breach Audit
Find it. Fix it. Kill it.
Leakill guides · 66 articles
Email security and data breach guides, in plain English
Learn how breaches work, what to do when your email or password leaks, and how to lock down your accounts. Every guide ends with a concrete next step.
Start here
Check & understand
How to check if your email was in a data breach
Find out in under a minute whether your email address appears in known data breaches, what the result means and exactly what to do next.
Check & understand
How do I know if my email has been hacked?
Ten warning signs that someone else is using your email account, how to confirm it, and the first five minutes of damage control.
After a breach
What to do if your email was in a data breach
Your email appeared in a breach. Follow this prioritised plan to secure your accounts, avoid scams and make the leak harmless.
After a breach
What to do if your password was leaked
A leaked password is dangerous only while you still use it. Here is how to replace it safely, find where it was reused and lock accounts down.
After a breach
How to recover a hacked email account
Locked out or noticing strange activity? Recover your hacked email account, remove the attacker and prevent it from happening again.
Passwords & 2FA
Two-factor authentication (2FA) explained simply
What 2FA is, why it blocks most account takeovers and how to set it up on your email and other important accounts.
Email providers
Is my Gmail account hacked? How to check and fix it
Check whether your Gmail account was hacked using last account activity, signed-in devices, forwarding rules and breach checks, then secure it step by step.
Phishing & scams
How to spot a phishing email: 12 warning signs
Learn the warning signs of phishing emails, how to check a link or sender safely and what to do with a message that feels wrong.
For businesses
How to check company email addresses for data breaches
How businesses can find out which employee and company email addresses appear in known breaches, and what to do with the results.
For businesses
Email security checklist for small businesses
A practical email security checklist for small teams: MFA, passwords, authentication records, training, backups and breach checks.
Check & understand
How breach checks work, what an exposed email really means, and how to read your results.
→How to check if your email was in a data breachFind out in under a minute whether your email address appears in known data breaches, what the result means and exactly what to do next.→How do I know if my email has been hacked?Ten warning signs that someone else is using your email account, how to confirm it, and the first five minutes of damage control.→What is a data breach?A data breach exposes information to people who should not see it. Learn how breaches happen, what data leaks and why it matters to you.→Email leaked vs email hacked: what’s the difference?A leaked email and a hacked email account are not the same thing. Learn the difference, the risks of each and how to respond.→What does “your email was exposed in a breach” mean?Your email shows as exposed in a breach. Here is what that means, how serious it is and the realistic risks to plan for.→Is it safe to check your email for breaches?Breach checkers are generally safe if you know what to look for. Learn what is safe to enter, red flags of fake tools and how to protect yourself.→How data breach checkers work, and what they can’t tell youHow breach lookup tools collect data, match your email and why no checker can promise a complete answer. Plain explanation for non-technical readers.→What a detailed breach report shows, and when it’s worth itA free breach check says if you were exposed. A detailed report explains where, when and what to do. Here is what it contains and when it is worth it.→How often should you check your email for breaches?How often to run a breach check, when to check sooner and how to build a light routine that keeps you ahead of leaks.→Have I Been Pwned alternatives: other ways to check for leaksLooking beyond Have I Been Pwned? Compare the types of breach-checking tools, what they offer and how to choose the right mix.
After a breach
Step-by-step recovery plans for leaked emails, leaked passwords and hijacked accounts.
→What to do if your email was in a data breachYour email appeared in a breach. Follow this prioritised plan to secure your accounts, avoid scams and make the leak harmless.→What to do if your password was leakedA leaked password is dangerous only while you still use it. Here is how to replace it safely, find where it was reused and lock accounts down.→How to secure your email account after a breachA practical email security checklist: password, 2FA, recovery options, sessions, forwarding rules and connected apps, in the right order.→Which passwords to change first after a breachChanging every password at once is exhausting. Use this priority order to protect the accounts attackers target first.→Should you delete an account after a data breach?Deleting a breached account can reduce future risk, but not always. Learn when to delete, when to keep and how to do it safely.→How to recover a hacked email accountLocked out or noticing strange activity? Recover your hacked email account, remove the attacker and prevent it from happening again.→How to tell if someone is reading your emailAttackers can read your mail without you noticing. Check forwarding, filters, sessions and connected apps to find out.→How to check email forwarding rules and filters for hidden accessHidden forwarding rules are a favourite attacker trick. Learn how to find and remove them in Gmail, Outlook, Yahoo and other providers.→How to sign out of all devices after a security scareChanging your password may not end every session. Sign out everywhere, revoke app access and make sure attackers are locked out.→I clicked a phishing link. What should I do?Clicking a phishing link is common and fixable. Here is exactly what to do depending on whether you only clicked or also entered details.→My email is sending spam: hacked or spoofed?Friends say you emailed them spam. Find out whether your account was hacked or your address was spoofed and what to do in each case.
Passwords & 2FA
Strong passwords, password managers, passkeys and two-factor authentication without the jargon.
→How to create a strong password you can actually useLength beats complexity. Learn how to build strong passwords and passphrases, what to avoid and how to manage them without memorising dozens.→How to stop reusing passwordsPassword reuse is the main reason leaks turn into account takeovers. Here is a realistic plan to replace reused passwords, starting with the ones that matter.→How to check if your password was leakedLearn how to find out if a password has appeared in known leaks, safe ways to check and what to do if it has.→What is credential stuffing, and how do you stop it?Credential stuffing is how leaked passwords unlock accounts on other sites. Learn how it works and how to stay safe.→Two-factor authentication (2FA) explained simplyWhat 2FA is, why it blocks most account takeovers and how to set it up on your email and other important accounts.→SMS vs authenticator app vs security key: which 2FA should you use?Compare the main two-factor methods by security, convenience and risk, and learn which one to choose for each account.→Passkeys explained: are they better than passwords?Passkeys replace passwords with cryptographic keys on your device. Learn how they work, why they resist phishing and how to start using them.→Password managers for beginners: are they safe and how do you start?A plain-English guide to password managers: how they work, whether they are safe, how to choose one and how to get started in an afternoon.→Backup codes and account recovery: set them up before you need themLocked out of an account is stressful. Set up backup codes, recovery email and phone the safe way so you can always get back in.→Email aliases explained: how to hide your real addressAliases let you give every website a different address that forwards to your inbox. Learn how they limit spam, tracking and breach exposure.
Email providers
Provider-specific checks for Gmail, Outlook, Yahoo, iCloud, Proton Mail and more.
→Is my Gmail account hacked? How to check and fix itCheck whether your Gmail account was hacked using last account activity, signed-in devices, forwarding rules and breach checks, then secure it step by step.→Is my Outlook or Hotmail account hacked? Check and secure itHow to check Outlook and Hotmail accounts for unauthorised access using Microsoft account activity, rules, forwarding and sign-in history.→Is my Yahoo Mail account hacked? How to check and secure itCheck your Yahoo Mail for signs of a hack, review recent activity and forwarding, and secure the account after Yahoo’s past breaches.→Is my iCloud or Apple Mail account hacked? What to checkHow to check iCloud and Apple Account activity, signed-in devices and mail settings, and what to do if you suspect unauthorised access.→How to secure your Proton Mail accountProton Mail is privacy-focused, but accounts can still be taken over. Learn what to check and how to harden your account.→How to secure or retire an old email addressOld and secondary email addresses are often the most exposed and least protected. Learn how to secure, repurpose or safely retire them.→Should you use a separate email address for banking?A dedicated, private email for banking and finance reduces exposure to spam, phishing and breaches. Here is how and why to set one up.→Email security for freelancers and remote workersWorking from anywhere means your inbox is your office. Practical email security for freelancers, contractors and remote workers.
Phishing & scams
Recognise scams that use leaked data, from fake breach alerts to ‘I have your password’ emails.
→How to spot a phishing email: 12 warning signsLearn the warning signs of phishing emails, how to check a link or sender safely and what to do with a message that feels wrong.→What is spear phishing? Targeted email attacks explainedSpear phishing uses personal details, often from data breaches, to craft convincing targeted emails. Learn how it works and how to defend yourself.→“I have your password” email scam: is it real?Got an email quoting your real password and demanding payment? Here is how the sextortion scam works, why it is usually a bluff and what to do.→Fake data breach notification emails: how to tellScammers send fake breach alerts to steal logins. Learn how to verify a real data breach notice and avoid the fake ones.→Email spoofing explained: how fake senders workEmail spoofing forges the sender address so a message appears to come from someone you trust. Learn how it works and how to protect yourself.→How to report a phishing email, and why you shouldReporting phishing protects you and others. Learn how to report suspicious emails to your provider, your employer and the authorities.→How to check if a link is safe before you clickPractical ways to inspect a link, spot lookalike domains and decide whether to click, without special tools.
For businesses
Employee email exposure, domain monitoring, business email compromise and practical audits.
→How to check company email addresses for data breachesHow businesses can find out which employee and company email addresses appear in known breaches, and what to do with the results.→Employee email exposure: why leaked work emails are a business riskLeaked employee emails enable phishing, credential stuffing and impersonation. Learn the real risks and how to reduce them.→Business email compromise (BEC) explainedBEC scams trick staff into paying fake invoices or changing bank details. Learn how they work, warning signs and the controls that stop them.→Email security checklist for small businessesA practical email security checklist for small teams: MFA, passwords, authentication records, training, backups and breach checks.→SPF, DKIM and DMARC explained for small teamsWhat SPF, DKIM and DMARC are, why they stop email spoofing and how a small business can set them up step by step.→Domain breach monitoring for small businessesHow to watch for company email exposure over time, what domain monitoring covers and how to make it a routine.→Offboarding employees: how to close email and account access safelyA checklist for safely removing email and account access when employees leave, so dormant accounts do not become a breach risk.→How to run an email security audit for your companyA step-by-step approach to auditing company email: accounts, exposure, authentication, rules and training, with a practical scoring checklist.
Famous breaches
What happened in the biggest public data breaches, and how to find out if you were affected.
→Yahoo data breach (2013): what happened and what to doThe 2013 Yahoo breach is one of the largest ever reported. Learn what happened, what data was exposed and how to check if you were affected.→LinkedIn data breach: the 2012 leak and its 2016 resurfacingHow the 2012 LinkedIn breach exposed passwords, why it resurfaced in 2016 and what to do if you had an account.→Adobe data breach (2013): what was exposedThe 2013 Adobe breach exposed customer records and poorly protected passwords. Learn what happened and how to protect yourself.→Dropbox data breach (2012): what happened and what to doIn 2016 Dropbox confirmed that a 2012 breach exposed about 68 million accounts. Here is what was leaked and how to protect yourself.→MySpace data breach: what was exposed and why it still mattersOld MySpace credentials surfaced in 2016. Learn what was exposed, why legacy accounts matter and how to check yourself.→Facebook 533 million data leak (2021): what it includedDetails of about 533 million Facebook users were posted online in 2021. Learn what the data included and what the leak means for you.→Canva data breach (2019): what happened and what to doThe 2019 Canva breach exposed details of about 137 million users. Learn what was taken and how to secure your account.→Collection #1 data breach: what the 773 million email list wasCollection #1 was a huge compilation of leaked credentials found in 2019. Learn what it was, why it matters and how to check your email.→Marriott Starwood data breach: what guests should knowThe Starwood guest reservation breach disclosed by Marriott in 2018 exposed personal and passport data. Learn what happened and what to do.→MyFitnessPal data breach (2018): what happenedIn 2018 Under Armour disclosed a MyFitnessPal breach affecting around 150 million accounts. Learn what was exposed and what to do.→Verifications.io email leak: how 763 million addresses were exposedAn email-validation service left a database open in 2019, exposing hundreds of millions of addresses. Learn why you may be in it without knowing.→RockYou data breach: the leak that shaped password crackingThe 2009 RockYou breach exposed about 32 million plaintext passwords and created the most famous password wordlist. Here is the story and lesson.
Ready to see where your email stands?
The free check searches known breach records for your address. No password, no signup.
Start free check →