Dark web monitoring: what "your email appeared in a breach" actually means

A breach notification is alarming and rarely actionable — it tells you something happened without telling you what to do. Here's how to read one properly and what genuinely needs your attention.

What a breach alert actually means

Your email address appeared in a dataset from a compromised service. That's it. It does not mean your email account was hacked, or that anyone has your current passwords.

What matters is what else was in the dataset alongside your address:

• Email address only — low risk. Expect more spam and phishing
• Email plus a password hash — depends heavily on the hashing. Modern bcrypt or Argon2 is slow to crack; old MD5 or SHA-1 without salt is effectively plaintext
• Email plus a plaintext password — urgent. Assume the password is public
• Email plus personal details (address, date of birth, ID numbers) — identity fraud risk that doesn't expire with a password change

The real threat is reuse, not the breach

Attackers don't usually target you specifically. They take millions of leaked email/password pairs and replay them automatically against banks, email providers and shopping sites. This is credential stuffing, and it works because people reuse passwords.

A breach at a forum you forgot about in 2015 is harmless — unless that password also opens your email today.

What to do, in order

1. Change the password on the breached service — or delete the account if you no longer use it. Dormant accounts are liabilities.

2. Change it everywhere else you used it. This is the step that matters. If you can't remember where, that's the strongest possible argument for a password manager.

3. Prioritise your email account above everything. Every password reset lands there. If one account gets a unique, strong password and MFA today, make it that one.

4. Turn on MFA on anything important — email, banking, password manager, domain registrar. Even a leaked password is largely useless without the second factor. See 2FA vs passkeys.

5. Check for forwarding rules and filters you didn't create. After a mailbox compromise, attackers frequently leave an auto-forward or auto-delete rule so they keep reading after you change the password. Almost nobody checks this. In Tobava Mail these live on two separate screens in Settings — check both.

6. Watch for targeted phishing. Breach data feeds convincing follow-ups — messages referencing a real service you used, sometimes quoting a real old password to establish credibility.

What you don't need to do

• Don't panic-change every password at once. Prioritise reuse and high-value accounts
• Don't pay anyone to "remove your data from the dark web." It isn't possible; copies are already distributed
• Don't ignore old breaches. Age doesn't matter if the password is still in use somewhere

The sextortion email

A common follow-up: an email quoting one of your old passwords, claiming your webcam was recorded, demanding payment. The password is real — from a breach dump. Everything else is fabricated. Delete it, and change that password anywhere it's still in use.

Getting ahead of it permanently

• A password manager, so every account has a unique password you never need to remember
• Passkeys where offered — nothing reusable exists to steal
• Aliases per service, so a breach reveals only which service leaked, and can be disabled
• MFA everywhere it's available