How to Check if Your Data Was in a Breach

When breached data becomes public, often posted on forums or leak sites, researchers and services obtain and index it. Lookup services let people search their email address or phone number against that index and see which breaches included their details and what types of data were exposed.

The HIBP service (haveibeenpwned.com), run by security researcher Troy Hunt, is the most widely used free lookup. It lists the breaches in which an email appears and the data types exposed, offers notifications for future breaches, and provides a domain search for organisations. Its Pwned Passwords service lets systems check passwords against known breached passwords using a privacy-preserving range query.

Password managers and some browsers check saved credentials against breach data. Credit and identity monitoring services may alert on exposed financial details. Some national agencies and companies notify individuals directly. Be cautious with unknown lookup sites, which can themselves be used to harvest addresses.

Use only reputable services. Never type your actual password into a website to check it; trusted password checks use techniques that never send the full password. Be wary of emails claiming you were breached that ask you to click links or log in, which is a common phishing approach.

A match means your email or number appeared in a dataset from a known breach. It does not necessarily mean your account was taken over. The risk depends on what was exposed: an email alone mainly means more spam and phishing; a password, especially one you reused, means accounts may be at risk.

Change the password for the breached service and any other service where you used the same password. Use a password manager to create unique passwords. Enable multi-factor authentication, preferably with an authenticator app or security key. If financial or identity data was exposed, consider credit freezes and monitoring. Watch for targeted phishing referencing the breach.

Security teams can monitor breach data for their own domains to find exposed employee accounts, then force password resets and check for reuse. Checking new passwords against known breached passwords at registration and reset blocks credentials attackers already have. Exposed credentials are a common starting point for attacks on corporate systems.

Lookup services only know about breaches that became public and that they obtained. Many breaches are never published, and some data circulates privately. A clean result is reassuring but not proof that your data is safe.

Organisations that suffer breaches may be required to notify affected individuals directly. Lookups complement those notices, especially when breaches are discovered through leaked data rather than disclosed by the company.

Use unique passwords, MFA everywhere it is offered, email aliases for less trusted services, and minimal personal data in sign-ups. These habits limit what any single breach can expose.

Phone numbers appear in many breaches and are used for SIM-swap fraud and phishing by text. If your number appears in a breach, add a carrier PIN or port-out protection, avoid SMS as your only second factor where better options exist, and treat unexpected texts with links cautiously.

When a breach is reported in the news, lookup services may add it only after the data becomes available to them, which can take days or never happen. Companies' own notifications and regulator filings are often the first reliable source on what was exposed and who is affected.

Attackers take email and password pairs from one breach and try them on other sites, an attack called credential stuffing. Reused passwords are the reason a breach of a minor site can lead to takeover of important accounts. Unique passwords stop this attack entirely.

Most lookup services offer free notifications when your email appears in a newly added breach. Organisations can subscribe to domain-wide alerts. Pair notifications with a habit of rotating any affected password immediately, before attackers attempt to reuse it.

Check shared and family email addresses, as well as small business admin accounts, which often reuse passwords and lack MFA. A compromised admin mailbox can lead to takeover of domains, banking, and customer accounts.