An email breach lookup concerns historical exposure in data available to a provider. It is not a live test of whether someone can currently sign in to an account. Review the context and exposed data types before deciding what action is needed.
Exposure is different from current compromise
An email appearing in breach data does not automatically mean its current password was exposed. Records may concern contact details, old credentials or other account data. Have I Been Pwned distinguishes verified, unverified and fabricated breach records; evidence labels matter.
Use MyRecon with coverage in mind
MyRecon provides supported breach-exposure research alongside username and domain tools. Availability depends on platform, provider and access limits. Review the actual result and its coverage instead of assuming every dataset or sensitive record is included.
What a missing result means
No result means no matching record was returned by that check, not that the address has never been exposed. A failed request is a separate state: the lookup did not complete. Keep these outcomes distinct in your notes.
Respond to relevant exposure
- Review the service, exposure date and affected data categories. Open the service through a trusted address, not a breach-themed email link.
- If an affected password is still in use, replace it and any reused copies with distinct passwords.
- Review recovery information, available multi-factor authentication and recent activity in the service's own settings.
- For an organizational account, report the relevant evidence through your established security process.
Keep password and email checks separate
HIBP's email records and Pwned Passwords service answer different questions. A password match alone does not identify whose account used it. Do not invent an email-and-password association from independent results, and never include a current password in a review report.
Use exposure as a reason to review security, not as proof of an active attacker or a complete history of your accounts.