How to check if your email was in a data breach
Search your email address in a breach index such as Have I Been Pwned or XposedOrNot; DuckINT queries several breach and leak indexes in one search. The result lists each breach, when it happened and which kinds of data leaked. If passwords were exposed, change that password everywhere you used it and turn on two-factor authentication.
How to check
- Open DuckINT and type your email address into the search box.
- Read the breach results: each entry names the breached service, and where the index provides them, the breach date and the exposed data classes (for example email addresses, passwords, phone numbers).
- Repeat for every address you use, including old ones that still receive mail.
Breach indexes only know about breaches that became public and were added to them. "No records found" means none of the indexed breaches include the address; it is not proof that the address never leaked.
What to do if your address appears
- Change the password of every breached service you still use, and anywhere else you reused that password.
- Use a password manager so every account gets its own long, random password.
- Turn on two-factor authentication, preferably an authenticator app or a security key rather than SMS.
- Expect targeted phishing: breached addresses receive convincing fake emails that mention the breached service.
- If financial or identity data leaked, watch your bank statements and consider a credit freeze where available.
Why a breach matters even years later
Leaked email-and-password pairs are collected into large lists and tried automatically against other sites (credential stuffing). An old breach is dangerous as long as the password is still in use somewhere.
Questions
- Is it safe to type my email into a breach checker?
- Use services that only return breach metadata. DuckINT and the indexes it queries return breach names, dates and data classes, never the leaked passwords themselves.
- My email is in a breach but I never used that site. Why?
- Someone may have signed up with your address, the site may have bought or merged a mailing list, or the breach includes data from a third party the site shared it with.
- Should I delete the breached account?
- If you no longer use it, change the password first, then delete it, so a stale account cannot be taken over later.