Facebook Data Breach: Check Your Account

If you’re worried that your Facebook account may have been exposed in a data breach, this guide shows you how to check quickly and safely. You’ll learn to use Facebook’s own security tools and trusted third-party breach checkers to see if your email or phone number was leaked, and what to do if it was.

What You’ll Need

Your Facebook login credentials (email or phone number and password).
Access to the email address or phone number associated with your Facebook account.
A web browser on your computer or the Facebook mobile app.
Optional: a second email address or phone number for added verification.

Step-by-Step

Log into Facebook. Go to facebook.com and sign in with your usual credentials. If you can’t log in, use the “Forgot account?” link to recover access first.
Open Security and Login settings. Click your profile picture (top right), then select Settings & privacy > Settings. On the left sidebar, click Security and login.
Check “Where You’re Logged In”. This section shows all devices and locations where your account is active. Look for any unfamiliar sessions. If you see one, click the three dots next to it and select Log out.
Review “Login Alerts”. In the same Security and login page, scroll to Setting up extra security. Make sure Get alerts about unrecognized logins is enabled. You can choose to receive alerts via email, notification, or both.
Check your email for breach notifications. Go to your email inbox and search for “Facebook security” or “Facebook login”. Facebook often sends alerts if it detects suspicious activity. If you see a warning about a login from an unknown device, follow the instructions to secure your account.
Use a third-party breach checker (optional but recommended). Visit a reputable site like Have I Been Pwned (haveibeenpwned.com). Enter your email address or phone number (the one you use for Facebook) in the search box. The site will tell you if that information appears in any known data breaches.
Check your phone number too. If you use a phone number for Facebook, enter it in the same breach checker. Many breaches include phone numbers, and Facebook may not always alert you.
Change your password if needed. If you find your email or phone in a breach, or if you see any suspicious activity, change your Facebook password immediately. Go to Settings > Security and login > Change password. Choose a strong, unique password.
Enable two-factor authentication (2FA). In the same Security and login page, under Setting up extra security, click Use two-factor authentication. Follow the prompts to set it up using an authenticator app or text message.
Review connected apps. Go to Settings > Apps and websites. Remove any apps you don’t recognize or no longer use. These can be a vector for unauthorized access.
Check your Facebook profile for changes. Look at your profile picture, cover photo, and personal info. If anything was changed without your knowledge, revert it and note the time of the change to report if necessary.

Common Mistakes

Ignoring login alerts. Many people dismiss Facebook’s security notifications as spam. Always read them carefully.
Using the same password everywhere. If your password was in a breach, it could be used to access other accounts. Change it on all important sites.
Not checking phone numbers. Breach checkers often only check email addresses. Remember to check your phone number as well.
Clicking links in suspicious emails. Phishing emails often impersonate Facebook. Always go directly to facebook.com rather than clicking links in emails.
Forgetting to log out of old devices. Even if you change your password, a logged-in session on an old phone might still work. Use the “Where You’re Logged In” feature to log out of all devices.

Tips

Use a password manager. It generates and stores strong, unique passwords for each site, so you don’t have to remember them.
Turn on login approvals. This is Facebook’s name for 2FA. It adds a second step when logging in from a new device.
Monitor your email regularly. Set up alerts in your email client for any messages from Facebook.
Use the Security Checkup tool. Facebook has a built-in tool that walks you through securing your account. Find it at facebook.com/security_checkup.
Keep your recovery email and phone up to date. If you lose access, you’ll need these to get back in.

Troubleshooting

If you can’t log into Facebook: Use the “Forgot account” link and follow the recovery steps. You may need to answer security questions or provide a code sent to your email or phone.

If the breach checker says you’re in a breach but Facebook shows no alerts: It’s still wise to change your password and enable 2FA. The breach may be old, but your data could be circulating.

If you see a login from an unknown location: Immediately log out that session, change your password, and enable 2FA. Also check your email for any password reset requests.

If you receive a suspicious email claiming to be from Facebook: Do not click any links. Forward it to phish@fb.com and delete it. Then check your account directly by logging in.

If you suspect your account has been completely taken over: Go to facebook.com/hacked and follow the instructions to secure it. Facebook will guide you through verifying your identity and recovering the account.

Frequently Asked Questions

Q: How do I know if my Facebook account was in a specific breach?
A: Use a service like Have I Been Pwned and enter the email or phone number you use for Facebook. It will list any breaches that include that info.

Q: What should I do if my email was in a breach but I haven’t noticed anything weird?
A: Change your Facebook password immediately, enable 2FA, and review your active sessions. Even if nothing looks wrong, your data could be used later.

Q: Can Facebook tell me if my account was compromised?
A: Facebook will send you alerts if it detects suspicious activity, but it may not know about every breach. You should proactively check using the steps above.

Q: Is it safe to use third-party breach checkers?
A: Yes, if you use reputable sites like Have I Been Pwned. They only check if your email or phone appears in known breach databases; they don’t ask for your password.

Q: What if my phone number is in a breach but my email isn’t?
A: Treat it the same as an email breach. Change your password, enable 2FA, and be extra cautious about phishing texts.

Q: How often should I check for breaches?
A: It’s a good habit to check every few months, or whenever you hear about a major breach in the news.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →