We got an alert saying our email was in a breach. What now?

An alert like this means an email address of yours appeared in data from some service's breach. It does not necessarily mean your mail account is compromised, and it does mean somebody now has a known-good address and possibly a password that was reused.

What to do, in order:

• Change the password on the breached service, and more importantly anywhere that same password was used. The reuse is the actual risk, not the original breach.
• Confirm multi factor authentication is on your email. If it is, a leaked password alone is not enough to get in, which is the whole reason it matters.
• Check the mailbox itself. Look for forwarding rules you did not create, rules that move or delete messages, and recent sign-ins from places you do not recognize. We can check this properly and quickly for managed clients.

What not to do: ignore it because the breached service seems unimportant. The service does not matter. The password does, and so does the fact that your address is now on a list.

If you get an email claiming to have your password and demanding payment, that is usually a bluff built on exactly this kind of breach data. Do not pay. Do change the password.