If you think your email was in a breach, do this first
Most people freeze, then reuse the same password on the next site. That's the part that actually gets them.
Do this, in order, on accounts you own:
Change the password on the account you think leaked. Do it from a device you trust.
Turn on 2FA. App or hardware key. Not SMS if you can avoid it.
Check whether that same password is still sitting on email, banking, or work logins. If it is, change those too — different password each time.
Sign out other sessions. Gmail, Apple, Microsoft, Discord all have a "where you're signed in" page.
Watch the inbox for password-reset mail you didn't ask for.
What not to do: paste the leaked password into a "checker" site. That's how a second leak starts.
A white-hat check should tell you that something showed up, not hand you the secret. If someone offers to send you the password file, walk away.