How to Check if Your Email Has Been in a Data Breach

Why This Matters

Over 10 billion email addresses have been exposed in data breaches since 2013. If your email is in a breach database, attackers may try credential stuffing attacks against your accounts using leaked passwords.

Step 1: Check Known Breaches

• Have I Been Pwned — Enter your email to search 13B+ accounts across 800+ breaches
• h8mail — 100% Free and Open-Source OSINT CLI tool for finding email leaks

# Install h8mail (Open Source Lab)
pip3 install h8mail

# Run a basic search against an email (no API keys required for basic search)
h8mail -t target@example.com

# Check password exposure (k-anonymity, no email needed)
# Hash your password with SHA-1 first, then check first 5 chars:
echo -n "YourPassword" | sha1sum | head -c 5
# Use the first 5 chars in:
curl -s "https://api.pwnedpasswords.com/range/FIRST5CHARS"
# Count occurrences after the colon on matching line

# Using HIBP API (requires free API key from haveibeenpwned.com)
curl -s -H "hibp-api-key: YOUR_API_KEY" \
  "https://api.haveibeenpwned.com/v3/breachedaccount/YOUR_EMAIL"

Step 2: Check Your Domain's Email Security

# Check SPF record (prevents email spoofing)
dig TXT yourdomain.com +short | grep "v=spf1"
nslookup -type=TXT yourdomain.com

# Check DMARC policy
dig TXT _dmarc.yourdomain.com +short

# Check DKIM (replace 'selector' with your actual selector)
dig TXT selector._domainkey.yourdomain.com

# Check MTA-STS (email transport security)
dig TXT _mta-sts.yourdomain.com

Step 3: Analyse Suspicious Email Headers

# Save email as raw .eml file, then:
grep -i "received:" email_raw.txt | head -20
grep -i "return-path:" email_raw.txt
grep -i "from:" email_raw.txt
grep -i "authentication-results:" email_raw.txt

# Check SPF/DKIM/DMARC alignment in header
grep -i "spf=" email_raw.txt
grep -i "dkim=" email_raw.txt
grep -i "dmarc=" email_raw.txt
# All should show "pass" for legitimate emails

Step 4: What To Do If You're Compromised

1. Change password immediately on the breached service
2. Enable 2FA — generate a TOTP code with our OTP Generator
3. Check bank and financial accounts for suspicious activity
4. Report to Cyber Crime Portal India or FBI IC3 (US)