What to do when your email appears in a data breach
Here is a straightforward look at this topic for Crazish.
Large websites are breached regularly, and lists of stolen email addresses and passwords are traded among criminals. Finding your address in such a list does not mean your accounts have been taken over, but it does mean the password used on that site should be considered public. The real danger comes when the same password protects other services as well.
Change the password on the breached site first, then on every other account that shared it, starting with email and banking. Use a unique password for each service and turn on two-step verification wherever it is offered. Watch for follow-up phishing messages that mention the breach, since criminals use the news to make their messages more convincing.