How to Stop Spam After a Data Breach Leaked Your Email

To stop spam after a data breach, separate two jobs: secure any affected accounts, then reduce unwanted mail. Report suspicious messages, use narrowly targeted filters, and give future registrations separate addresses. You cannot pull a leaked address back out of every copy of a mailing list. Changing a password protects access; it does not remove that address from spammers' lists.

Do not delete your old inbox in a panic. First check which accounts still need it for sign-in, security alerts, or recovery. A quieter inbox is not a win if you lose access to an important account.

1. Find out what happened before assuming your inbox was hacked

Open the affected company's website or app yourself, rather than following a breach-notice email. Look for its official notice and the types of data involved: an email address, passwords, payment details, or something else. Spam alone does not prove that somebody can read your mailbox.

Have I Been Pwned's FAQ explains that breaches do not always include passwords and that spam lists can combine information from several sources. If you choose to check your own address, navigate to the service directly; do not send passwords or recovery codes to someone offering a “breach cleanup.” A missing result is not an all-clear: the service says its records are incomplete.

If a password was exposed, replace it on the affected service and anywhere you reused it with distinct strong passwords. Follow the provider's incident instructions. If you see unfamiliar sign-ins, changed recovery details, or mail you did not send, treat that as possible account compromise—not simply a filtering problem.

2. Secure access before tidying the inbox

For a suspected mailbox takeover, use the provider's official recovery and security process. Google's compromised-account guide covers reviewing security events and devices, correcting recovery information, and removing unfamiliar forwarding rules and filters. These checks matter because an attacker-created rule can hide security messages even after you change a password.

Enable multi-factor authentication where available, and keep backup recovery methods somewhere protected and separate from that inbox. MFA helps protect account access; it is not a spam filter. If malware or stolen sessions are suspected, follow the provider's device-cleanup and session-revocation guidance rather than assuming one password change fixes everything.

Unexpected financial activity needs attention through the bank or service's known app, website, or phone number. Do not use contact details supplied in the suspicious message.

3. Reduce the noise without hiding the warning signs

Start with the mail provider's Report spam or Report phishing action. Gmail says spam reports help it identify similar messages; blocking one sender alone cannot stop mail arriving under new sender names.

For newsletters you recognize and actually requested, use a trusted unsubscribe route or the sender's site. For an unknown message demanding that you click to “remove your breached email,” do not reply, open attachments, or follow its unsubscribe link. A familiar company name or a detail from the breach does not authenticate the sender.

Then apply focused filters, not a blanket rule that deletes everything containing “password,” “invoice,” or “security.” Prefer a reviewable folder or label while you check whether the rule catches legitimate mail. Periodically inspect Spam for missed messages and correct false positives. Our practical spam-control guide explains the longer-term cleanup routine.

A sudden flood deserves a separate check. Gmail's spam guidance warns that a spam attack can bury security alerts. Look for unexpected orders, transactions, or account changes through the services themselves. The flood is a reason to investigate, not proof that a purchase or takeover occurred.

4. Move addresses without cutting your recovery route

A fresh address reduces future exposure only if you stop reusing it everywhere. Use a separate address for each service when practical, while securing the mailbox or alias provider behind them. An alias separates addresses; it does not automatically create a separate security boundary if all aliases share one compromised account.

For high-value accounts, choose a stable mailbox you control with recovery options you have verified. Do not move banking, healthcare, or your password manager's recovery to a disposable inbox just to reduce spam. Read our email-privacy guide for the broader trade-offs.

Change an account's address from its authenticated settings. Complete the site's confirmation steps, check the saved contact address, and verify that new mail arrives. Test ordinary sign-in and confirm an independent recovery method before retiring the old address. Do not log out of your only working session just to “test recovery.” If the site requires the old address and you cannot access it, use its official support or recovery route; success is not guaranteed.

Creating a new inbox does not update accounts already registered with the old one. Keep the old inbox under control until every dependent service has been checked. There is no universal waiting period that makes deletion safe.

5. The Inboxto three-slot migration card

This is an editorial planning tool, not a claim that we tested a breach or recovered a customer account. It uses a specific product constraint: Inboxto currently lists three addresses on Free, not an unlimited free address for every website.

For each available address slot, write down:

Check	What to record privately
Purpose	One low-consequence service or subscription, and its old address
Control	How you will reopen the destination inbox; verify access rather than just copying the address
Confirmation	Whether the service saved the new contact address and a new message arrived
Recovery	An independent recovery route and whether the old address is still required
Exit condition	Exactly what must be checked before the old address can be retired

For example, a fictional hobby forum might use one slot. Change its contact address while signed in, receive the confirmation, and check its recovery settings before considering the move complete. If that uses your last free slot, stop and reassess; do not delete another address whose dependent account has not moved. This is a planning example, not a product promise about restoring deleted addresses.

The Inboxto homepage describes persistent addresses, Free ordinary-message retention of 7 days, Premium retention of 90 days, and 5 starred messages on Free. Premium lists unlimited addresses and starred messages plus custom domains. Starring is a storage feature, not a way to extend a sender's reset-link deadline, restore deleted mail, or guarantee account recovery. Save important records separately and securely when appropriate.

There is an important documentation limit: the homepage says addresses persist until deletion, while Terms section 2 describes address expiry. The Terms also disclaim guaranteed delivery and uninterrupted service. Clarify long-term requirements with support; we do not turn the marketing wording into a lifetime-access guarantee. Our temporary-mail comparison helps distinguish address access from message retention.

A custom domain can give you more control over your address namespace, but still requires domain renewal, correct mail configuration, and secure access. It cannot erase a leak, guarantee delivery, or override another site's signup restrictions. See the custom-domain setup walkthrough before relying on one.

What success actually looks like

You may still receive spam at the exposed address. Success means suspicious messages are easier to handle, compromised access has been addressed, and future low-risk registrations no longer all expose the same address. A quiet inbox alone proves none of those things.

Keep the migration card private. Never include passwords, active reset links, or recovery codes in it or in support screenshots. Review any remaining accounts before closing an old inbox, and keep important alerts reachable throughout the move.

For your next low-risk newsletter or permitted signup, try Inboxto with a separate address—and verify how you will return to that inbox before depending on it.