Have I been in a data breach?
A breach check can identify known incidents tied to your accounts and the types of data they exposed. It cannot rule out undisclosed breaches, so use the results to prioritize password changes, credit protection, and data-removal work.
The scale of the breach problem
Known leak databases catalog compromised accounts from publicly disclosed breaches, and new breaches keep being added. They do not include breaches that stay private: data held by criminal groups, sold narrowly on closed forums, or never disclosed by the breached company.
What's in those records varies by breach. Common combinations:
- Credentials. Email + password, often hashed, sometimes plaintext.
- Personal identifiers. Name, address, phone, date of birth. Common in breaches involving customer records.
- Financial data. Partial card numbers, bank routing, transaction history. Some breaches.
- Government identifiers. Social Security numbers, driver's license numbers, passport numbers. Some breaches.
- Health data. Diagnoses, prescriptions, treatment history. Mostly health-sector breaches.
"Have I been in a breach?" is the wrong question. The right questions are which breaches, and what categories of your data ended up in each.
Large and older breaches still matter
Some large breaches have exposed Social Security numbers, health-insurance details, call records, and account data for very large numbers of people. Records from older breaches can keep circulating long after a breach is announced, so an old incident can still matter today. If you received a breach notice, or your Social Security number may be involved, read about Social Security number exposure.
See which known breaches include your email. The free scan checks your email against a known-breach index and shows the people-search sites listing you.
Run my free breach check →If you've used the same email for 10+ years, it may appear in several known breaches even if you don't remember the service.
What "being in a breach" actually costs you
Breach exposure can feed three kinds of attack:
- Credential stuffing. Attackers take your email + password from breach A and try them on services B through Z. It works when people reuse passwords. Unique passwords per service limit the damage, and a password manager makes them practical.
- Social engineering. An attacker knows your email, phone, address, and family from breach C, and calls your bank pretending to be you. Customer-support reps verify identity with exactly this kind of data. Each breach can make impersonation more convincing.
- Identity theft. Breach data combined with broker data can give a thief what they need to try to open credit, file taxes, or claim benefits in your name. See the full identity-theft risk picture.
What to do, in order
- Find out what's exposed. Run a Delist scan. It checks your email against a known-breach index and shows the people-search sites listing you.
- Rotate passwords on breached services + any services where you reused the password. Switch to a password manager such as 1Password or Bitwarden.
- Turn on 2FA where it's offered. SMS 2FA beats no 2FA; an authenticator app beats SMS; a hardware key beats both.
- Freeze your credit at all three bureaus. Free, federal. Makes it much harder to open new credit in your name.
- Reduce the surrounding broker data. An email-and-password breach is harder to weaponize when your name, address, family, and employer are not also published on data-broker sites. Removing the broker data is an easy step to skip. Delist takes on the removal process and tells you when a site needs something from you.
How Delist monitors going forward
On a paid plan, Delist rechecks your email against the known-breach index each week. When a newly indexed breach includes it, you get a notification in your account. You don't have to remember to check.
The free scan tells you where you stand today. The paid product is the watch.
Frequently asked questions
How many data breaches has the average American been in?
There is no single reliable average. Known leak databases catalog compromised accounts from many publicly disclosed breaches, and people who have used the same email for many years tend to appear in more of them. Checking your own email tells you more than an average would.
What's the difference between a leak and a breach?
In practice they're used interchangeably. A breach is the security event: unauthorized access. A leak is the data going public, when the stolen data ends up on a forum or in a torrent. Some breaches never leak (attacker holds the data privately); some leaks come from misconfigurations rather than breaches (public S3 bucket, exposed database).
Should I change my passwords after a breach?
Yes, for the breached service and any other service where you used the same or similar password. Use a password manager so you never have to think about which password went where. If the breach included a hashed password, modern hash algorithms (bcrypt, argon2) buy you time but not safety. Rotate.
Why am I still getting spam years after a breach?
Leaked breach data can be recompiled, resold, and recirculated for years, so an email address from an old breach can keep attracting spam. Leaked data is hard to pull back. Reducing the other personal data attackers can combine with it, such as your broker listings, makes it less useful.
Do breach databases cover every breach?
No. Known leak databases index publicly disclosed breaches plus some private submissions from researchers. Many breaches stay private: held by attackers, sold narrowly on closed forums, or never disclosed by the breached company. Coverage is best for publicly known events; your actual exposure may be higher.
Does my information disappear once the breach is fixed?
No. Fixing the vulnerability stops new data from leaking, but records already taken can be copied, traded, and folded into data-broker profiles before a fix lands. A patched breach doesn't un-publish what's already circulating. That's why removing your broker listings matters even after the company calls the incident resolved.