Is my email address in a data breach or on people-search sites?

Your email address is part of the supply chain that feeds every spam blast, phishing attempt, and account takeover that comes for you. It reaches attackers through two separate pipelines, and most people only know about one. Breaches dump your email — and often your password — in one-time events. Data brokers publish it continuously, right alongside your name, home address, and phone number. Both pipelines are active right now.

The source is mundane. Your email ends up in broker databases because you signed up for a loyalty card, filled out a mortgage application, or downloaded a free app that sold its permissions list. Delist removes your personal information from the internet — we surface both layers in one scan and keep filing on the broker listings that come back.

Two different pipelines: breaches vs. brokers

Email exposure splits cleanly into two categories. Treating them as one problem leads to half-defenses.

Breach exposure

A breach is a one-time event. A company you trusted with your email got hacked. The attackers leaked or sold the database — in some cases hundreds of millions of accounts in a single incident. Once your email is in a breach dump it lives permanently in commercial dark-web markets and breach-aggregator databases. There is no removing yourself from a breach.

Broker exposure

Broker exposure is continuous. People-search sites publish your email alongside your name and address as part of their normal product. They pull emails from public records, commercial databases, and sometimes breach data that gets re-aggregated into their feeds. Unlike a breach, broker exposure is removable — you can opt out of each site's database, and that's the work Delist takes on for you.

How to check email exposure

The free Delist.ai exposure scan checks both layers in a single pass.

The breach layer

The scan cross-references your email against known leak databases and reports which incidents your email appears in: the breach name, the date, what data was exposed (password hash, plaintext password, address, phone), and a severity assessment. Turn on ongoing breach monitoring and you get an alert the moment a new incident adds your email — before the credential stuffers do.

The broker layer

The same scan searches the web and returns site-by-site results showing which people-search sites publish your email alongside your other identity data. Where you're listed is where the removal work begins. You get a clear, site-by-site view of what's out there.

Both result sets in one report. No separate tools. No waiting.

What attackers do with a public email

Phishing and targeted spear-phishing

Bulk phishing runs on broker-published email lists — your address sitting on a people-search site is part of the supply chain. Targeted spear-phishing goes further: attackers combine your email with the rest of your listing (employer, family members, a recent address change) to build convincing impersonation emails. The richer your broker profile, the more credible the attack.

Credential stuffing

Attackers take email/password pairs from one breach and try them on hundreds of other sites, betting you reused the password. Most account takeovers don't require clever attacks — they require a password that already leaked somewhere else. A password manager that generates a unique password per site closes this attack surface.

Sextortion and extortion scams

Email extortion campaigns ("I have video of you," demanding crypto payment) run on bulk address lists scraped from breaches and broker sites. The targeting is shallow but the volume is high. Fewer sites publishing your email means less of this reaching you.

Account recovery hijacking

Most sites let users recover accounts through an email link. If an attacker can intercept or control your email, they effectively own every account tied to it. Two-factor authentication and a dedicated recovery address for high-value accounts — banking, investment, primary email — raise the bar considerably.

How to reduce email exposure

Four moves matter. Find and monitor what's already out there. Remove your email from the broker sites publishing it. Use aliases for new signups so future breaches don't reach your real address. Use a unique password everywhere so a leaked credential from one site can't open another.

Run the exposure scan and turn on monitoring

The free Delist scan covers both pipelines: known leak databases your email appears in, and the people-search sites that publish it. You get one consolidated report. Turn on breach alerts and you're notified when a new incident adds one of your addresses — early enough to rotate the password before attackers use it.

Remove from people-search sites

Your scan shows every site publishing your email. Delist's automated removal handles the submissions and re-verifications on each one, and we re-check because listings come back. We keep filing when they do.

Use email aliases

Apple's Hide My Email, Fastmail masked emails, SimpleLogin, and AnonAddy let you generate a unique email alias per site that forwards to your real address. If a site gets breached, only the alias leaks, and you can disable it without affecting anything else. This is the single most leveraged email-privacy move available to consumers.

Use a password manager and two-factor authentication

1Password, Bitwarden, KeePass, and similar tools generate and store unique passwords per site. The reused-password problem, the root cause of most account takeovers, goes away when every password is unique and randomly generated. Pair it with 2FA: hardware security keys (YubiKey, Titan) for high-value accounts, authenticator apps (Authy, Google Authenticator) for everything else, SMS only as a last resort because of SIM swap risk. 2FA defeats most credential stuffing attacks even when your password leaks.