How to Protect Your Email Address from Data Breaches

How email addresses get leaked

Data breaches happen when a company's database is stolen. Because email is the login for most accounts, leaked databases are full of email addresses, sometimes alongside passwords. Stolen data is then sold, shared, or used to send phishing and spam at scale.

Even companies with good security get breached. If a website has your address, that address is one breach away from being public.

Why a leaked address matters

A leaked email is a magnet for spam and phishing. Attackers send convincing fake messages pretending to be from services you use. Worse, if you reused a password, attackers can attempt it against banking, shopping, and email accounts.

Use disposable addresses to contain the damage

When you register on a site with a temporary address, a breach there exposes only that disposable address. It expires, and there is nothing to connect it to your identity or your real inbox. The damage is contained to a single, short-lived mailbox.

This is why privacy advocates recommend disposable addresses for everything except the handful of accounts that truly matter.

Check whether you have been breached

Use services such as Have I Been Pwned to check if your addresses appear in known breaches. If they do, change the passwords on those accounts immediately and use unique passwords going forward.

The three-layer defense

A strong email strategy has three layers: (1) a private, permanent address for critical accounts; (2) disposable addresses for everything else; and (3) a password manager with unique passwords. Together, these layers make you a very unappealing target.