How to check whether a business email address has appeared in a data breach

If a staff member’s business email address has appeared in a data breach, the practical risk usually isn’t the breach itself — it’s that the exposed password or details might be reused somewhere your business depends on. Checking is quick, free, and does not require specialist tools.

This guide is a walkthrough based on our review of Have I Been Pwned’s own documentation and public interface, not a hands-on test performed against any specific person’s account. Run the check yourself, or ask each staff member to run it against their own address.

What Have I Been Pwned actually does

Have I Been Pwned (HIBP) is a free public service that maintains a large, continually updated index of email addresses that have appeared in publicly known data breaches. You enter an email address, and it tells you which breaches — if any — included that address. It does not show you passwords or other breached data directly through the free search; it tells you which incidents your address showed up in, so you can act on that information.

It is not affiliated with the businesses that were breached, and using it does not notify those businesses that you searched.

Checking one address

1. Go to the Have I Been Pwned website.
2. Enter the business email address you want to check.
3. Review the result. A clear result means the address hasn’t appeared in HIBP’s indexed breaches — it does not guarantee the address has never been exposed anywhere.
4. If breaches are listed, read which services they relate to and roughly when each breach occurred.

What to do with the result

• If a breach involved a password, and that password (or a close variant) is reused on any current business account, change it there — not just on the breached service.
• If the breach is old and the account is inactive, the immediate risk is lower, but it’s still worth confirming the address isn’t still used to sign in anywhere with the same password.
• If several staff addresses show up across different breaches, that’s a signal worth acting on organization-wide — for example, checking multi-factor authentication coverage rather than treating each result as an isolated incident.

Checking a whole domain

HIBP also offers domain-level monitoring for organizations, which checks every address at your domain on an ongoing basis rather than one at a time. That requires verifying ownership of the domain and is a heavier commitment than a one-off check — worth considering once you’re checking more than a handful of addresses regularly.

Where this fits into a broader review

A breach-exposure check is one input, not a full picture of your public exposure. It tells you about credentials and addresses; it doesn’t tell you what services are exposed on your domains, what your DNS and certificates reveal, or how discoverable a specific employee’s identity is for impersonation purposes. Our External Exposure Assessment covers the infrastructure side, and our Digital Exposure Review covers the individual side — including impersonation risk that a breach check alone won’t surface.