How to Check If Your Data Has Been Leaked

HaveIBeenPwned tracks well over 14 billion breached accounts as of mid-2026. That number keeps climbing. If you have had an email address for more than five years, the odds are not that your data was exposed. The odds are that it was exposed multiple times.

LinkedIn lost 700 million records in 2021. Facebook had 533 million accounts scraped and leaked. Yahoo’s breaches affected 3 billion accounts — every Yahoo user, ever. Adobe, Dropbox, Canva, Twitch, Marriott, Optus, BSNL: the list of companies that have lost your data is longer than most people want to think about. RockYou2021 compiled 8.4 billion password pairs into a single file that circulated freely for months.

The average person has been in three to ten breaches without knowing it. Most breach notifications arrive late, go to spam, or never get sent at all. This guide shows you how to check your actual exposure, how to read the results honestly, and what to do the moment you find something.

The short answer: To check if your data has been leaked, enter your email at Have I Been Pwned (haveibeenpwned.com). It’s free and reliable, and it lists which known breaches included your address. Also use Google Password Checkup, Apple’s Passwords app, or Firefox Monitor for saved-password coverage. If a password shows up, change it everywhere you reused it and turn on two-factor authentication. Remember: these tools only show publicly disclosed breaches, so private sales and quiet corporate breaches stay hidden.

In this article:

What gets stolen in a breach

Not all breaches are equal. The damage depends on what type of data was taken.

Credentials — your email address paired with a password — are the most common. They fuel credential stuffing attacks, where attackers feed stolen login pairs into other sites automatically. If you used the same password on a breached site and on your bank, that breach is now a banking problem.

PII (personally identifiable information: your name, phone number, address, date of birth) is used for identity theft and social engineering. Knowing your birthdate and address is enough to pass security questions at many institutions. This data doesn’t expire. A breach from 2016 still has your current date of birth.

Financial data — card numbers, bank account details — is the most immediately dangerous but has become less common as payment processors hardened their systems. When it does appear, the window before fraud is hours, not days.

Sensitive personal data — health records, sexual orientation, political views, immigration status — is the highest-risk category for targeted individuals. These breaches are smaller but more harmful to specific people. The Ashley Madison breach (2015) exposed 37 million accounts with sexual preferences. The consequences for individual users were severe.

Knowing what category was stolen tells you how urgently and in what direction to respond.

What are the main tools for checking your exposure?

Several tools exist. Here is what each one actually covers and where it stops.

HaveIBeenPwned (haveibeenpwned.com) is the default starting point for anyone doing a data breach check. Enter your email address and it tells you which of the 800+ indexed breaches included that address, along with which data types were exposed in each breach. Troy Hunt, a Microsoft MVP and security researcher, built and runs it. It is free. The breach data is real. Trust it.

The limitation: HIBP only shows breaches that have been publicly disclosed and shared with the project. Private sales — breach data that’s traded on dark web markets but never posted publicly — don’t appear. If a breach happened but the company never disclosed it (and some don’t, especially outside the EU), HIBP won’t know either.

Google’s Password Checkup and Dark Web Report — if you use Chrome, Google already scans your saved passwords against known breach databases and flags compromised credentials. Google One subscribers get a dark web report for their Gmail address. This is useful if you’re already in the Google ecosystem, but it only covers your Google-managed data and saved passwords, not every account you’ve ever created.

Firefox Monitor — Mozilla’s breach notification tool, powered by HIBP data under the hood. Enter your email and see your breach history. You can subscribe to alerts for future breaches. Useful, but it duplicates HIBP without adding coverage.

Apple’s Passwords app (iOS 18+ and macOS Sequoia+) scans your iCloud Keychain passwords against breach databases and surfaces compromised logins. If you rely on iCloud Keychain, this catches credentials that HIBP wouldn’t. It knows which passwords you actually use, not just which emails were exposed.

Identity theft protection services like LifeLock, Identity Guard, and Aura monitor more broadly. That covers credit reports, non-breach data broker exposure, Social Security number monitoring (for US users), and bank account monitoring. They cost $10–$30 per month. They help if you’ve been a victim of identity theft or have specific reasons to need continuous monitoring. For most people, the free tools above cover the core risk. The paid services are often overpriced for what they add on top of what you can do yourself.

For developers: HIBP offers an API that lets you check email addresses and passwords programmatically. The password endpoint uses k-anonymity, meaning you never send the actual password to the server.

How do you read your results?

When HIBP returns results, the output needs some interpretation.

A breach marked “Sensitive” means the data involves something that could harm you if publicly known — adult sites, political data, health services. HIBP doesn’t display these publicly; you only see them in your own results. Take them seriously.

If a password was part of the breach, act immediately. Change that password on the breached site. Then go through every other site where you used the same password and change it there too. This is not optional. Credential stuffing is automated and starts within hours of a breach dump appearing online.

If PII (name, address, phone, date of birth) was in the breach, monitor your credit reports and financial accounts for unusual activity. In the US, request your free annual credit reports at annualcreditreport.com. In the EU, you have the right to contact the data controller and request what data they hold under GDPR Article 15. In India, watch for phishing attempts that reference your real name or address — that detail means the caller or emailer has real data.

If financial data was exposed, contact your bank. Don’t wait for fraud to appear. Ask for new card numbers if card data was part of the breach. Set up transaction alerts if you haven’t already.

What breaches do checking tools miss?

This is the part most guides skip. The free tools show you a fraction of your actual exposure.

Private dark web sales are breach data that has been sold to specific buyers but never posted publicly. A buyer purchases exclusive access to a fresh breach — say, a mid-size e-commerce company — and uses it quietly for months before the data ever surfaces in public dumps. HIBP and Firefox Monitor will never know about it.

Targeted corporate breaches are often small and quiet. An attacker who wants access to one specific organization doesn’t post the results publicly. The breach may never be disclosed because the company doesn’t know it happened.

Breaches in countries with weak disclosure laws often go unreported. India introduced mandatory breach notification requirements through CERT-In’s Directions (April 2022, effective June 2022), which mandated 6-hour incident reporting. The US has state-by-state disclosure laws with significant variation. Many countries have no disclosure requirement at all. If a company operating in those jurisdictions lost your data in 2020, there was no legal reason for them to tell you.

The checking tools are genuinely useful. They’re just not a complete picture of your exposure.

After you find a breach: the priority checklist

You searched your email and found results. Here is the order in which to respond — don’t try to do everything at once.

Change the breached password immediately. Then search your memory (or your password manager) for every other site where you used that same password. Change it on each of those too. This is the highest-leverage action you can take right now.
Enable two-factor authentication (2FA) on the affected account. Use an authenticator app (Google Authenticator, Authy, or your password manager’s built-in TOTP) rather than SMS if you have the option. SMS 2FA can be bypassed via SIM swapping.
Expect targeted phishing. If your email address was in a breach, attackers know you had an account with that service. You will receive emails that look like they’re from that company, often referencing the real service name and sometimes your real name. Do not click links in those emails. Go directly to the site by typing the URL.
If financial data was included: contact your bank the same day. Request new card numbers. Set up transaction alerts. Check your statements for the past 90 days for anything unfamiliar.
If your national ID was exposed — SSN in the US, Aadhaar in India, NIN in the UK, SIN in Canada — consider a credit freeze. In the US, you can freeze your credit for free at all three bureaus (Equifax, Experian, TransUnion) via their websites. A freeze doesn’t hurt your credit score and blocks anyone from opening new accounts in your name. In other countries, contact your national credit bureau for equivalent options.
If your address and phone were exposed: check whether your data has been amplified onto data broker sites. Brokers buy and aggregate breach data and resell it. One breach can turn into your profile appearing on dozens of people-search sites within weeks.

How do you stay ahead of future breaches?

The reality is you cannot prevent companies you trust with your data from getting hacked. What you can control is the blast radius when it happens.

Use a different password on every site, without exception. A password manager (Bitwarden is free and open source; 1Password and Dashlane are strong paid options) makes this manageable. Reusing passwords is the single behavior that turns one breach into ten problems.

Use a unique email alias for each service you sign up for. SimpleLogin (now owned by Proton) and DuckDuckGo Email Protection let you create addresses like yourname.amazon@duck.com that forward to your real inbox. When a breach happens, you know exactly which service leaked your data, and you can disable that alias without touching your real address. We cover this in more detail in our email alias and phone mask guide.

Sign up for breach notifications on HaveIBeenPwned. When a new breach is indexed and your email appears in it, you’ll get an alert. Early notice gives you time to act before attackers run credential stuffing campaigns against the fresh data.

Run a check on your email at least once a year — not just when you hear about a major breach. Breaches from years ago surface in public dumps regularly as they move through the dark web ecosystem. A breach that happened in 2022 might only show up in HIBP’s database in 2025 when someone finally posts the data publicly.

Consider monitoring your name and phone number on data broker sites as part of your annual check. Breach data gets picked up by people-search sites automatically and often. A service that submits removal requests under GDPR, CCPA, and India’s DPDPA gives you a way to get it removed rather than just watching it spread. KnytX Shield is built to do this automatically once it launches. A single breach event can seed dozens of broker profiles within months.

Have you ever received a breach notification email and ignored it because it seemed low-risk? That email was probably right about the breach. It was probably wrong about the risk. Credential stuffing attacks are indifferent to whether the site that leaked your password seemed important.

Frequently asked questions

How do I check if my data was leaked? Enter your email at Have I Been Pwned (haveibeenpwned.com). It’s free and lists the known breaches that included your address. Add Google Password Checkup or Apple’s Passwords app to cover your saved passwords.

Is Have I Been Pwned safe and accurate? Yes. It’s built by security researcher Troy Hunt, the breach data is real, and the password checker never sends your actual password. It only shows publicly disclosed breaches, though, not private sales.

My email was in a breach. What now? Change that password on the site and everywhere you reused it, then turn on two-factor authentication. Expect targeted phishing, and freeze your credit if a national ID was exposed.

How often should I check? At least once a year, not just after a big news story. Old breaches surface in public dumps regularly. Sign up for Have I Been Pwned alerts so you’re notified automatically. Also watch where your details land on people-search sites.

What you can do right now

Want to see what data brokers expose about you? See what a scan finds → shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist to get in early.