How can I check if my personal data has been leaked online?
Use Breach Notification Services
Several free services aggregate known data breaches and let you search your email address or phone number. Have I Been Pwned is the most widely used and trusted; it tells you which breaches included your data. Other options include Firefox Monitor (which uses Have I Been Pwned's data) and Google's Password Checkup for saved passwords.
These services only cover breaches that have been publicly reported or discovered. If a breach hasn't been disclosed, they won't know about it. So a clean result doesn't guarantee your data is safe.
- Have I Been Pwned – search by email or phone
- Firefox Monitor – free breach alerts
- Google Password Checkup – checks saved passwords
- Identity theft protection services (e.g., LifeLock, IdentityForce) – paid, monitor dark web
Monitor Your Accounts and Credit
Check your bank, credit card, and other financial accounts regularly for unauthorized transactions. In the U.S., you can get free credit reports from AnnualCreditReport.com (weekly free reports are available). Look for accounts or inquiries you don't recognize.
Set up fraud alerts or credit freezes with the major credit bureaus (Equifax, Experian, TransUnion) if you suspect your data is compromised. A freeze prevents lenders from accessing your credit report, making it harder for identity thieves to open new accounts.
- Review bank and credit card statements monthly
- Get free credit reports from AnnualCreditReport.com
- Consider a credit freeze or fraud alert
- Enable transaction alerts with your bank
Check Dark Web Monitoring
Some paid services scan dark web marketplaces and forums for your personal information, such as Social Security numbers, credit card numbers, and passwords. These services can alert you if your data appears for sale. However, they are not comprehensive and can produce false positives.
You can also manually search for your email on sites like Have I Been Pwned, but dark web searches typically require a subscription. If you find your data, change passwords immediately and enable two-factor authentication.
- Paid services: LifeLock, IdentityForce, Experian Dark Web Scan
- Free: Have I Been Pwned (email only)
- Change compromised passwords right away
- Enable two-factor authentication everywhere
Common mistakes
- Assuming a clean result from a breach-checking site means your data is safe—many breaches go unreported.
- Only checking one email address when you may have used multiple emails or usernames across sites.
- Ignoring the need to change passwords after a breach; even old passwords can be used for credential stuffing.
