TIL you can check if your email leaked without paying for a monitoring service
My bank sent me a weird text last month asking me to confirm a $480 charge at a gas station two states away. I caught it in time and got the card shut off, but it got me wondering how my info got out there in the first place. A coworker at the office in Boise told me to go to haveibeenpwned.com and just type my email in, and it turns out I showed up in four different breaches going back to 2019. I had no idea that site was free and didn't make you sign up for anything. I spent about an hour changing passwords on the accounts tied to that address and turned on two factor everywhere I could. The one that got me was an old shopping login I had not touched in over two years. If you have not checked your address there, it takes ten seconds and it might surprise you. Has anyone here found a breach on an account they totally forgot they even had?
An old Zappos login from 2013 popped up for me on there, I had not thought about that account in years. What worked for me was going through my password manager and sorting by oldest last changed, then hitting the worst ones first instead of trying to fix everything in one night. Also check if your email is the recovery address on any old accounts you stopped using, because that is how someone got into my brother's hotel rewards and drained his points. Do you use the same password on more than one site? That is the part that usually turns one breach into five.