You may have signed up for Service A, which was later bought by or merged with Service B. Some companies shells for marketing purposes based on data they bought from third parties. When that database leaks, your email is included even if you never set a password. Sometimes, the breach isn't from the website itself So, since you can't log in to change that password. The biggest risk isn't the '''non existent''' account but it's the password associated with it. If you use the '''same password''' for that email on other sites, change those '''immediately'''. Look at your monitor to see '''when''' the breach occurred. If it's very old, and you've changed your main passwords since then, you are likely already protected. Ensure 2FA is active on your primary email and any financial accounts.