In short
Search your email address in a breach-notification service such as Have I Been Pwned, which lists 1,048 breached websites as of 3 November 2026 [1]. A breach is data exposed in a vulnerable system [2]. On its own, a hit is not proof your account was hacked. If a breach involved your password, change it and enable multi-factor authentication [3].
Key takeaways
- As of 3 November 2026, Have I Been Pwned lists 1,048 pwned websites and 17,846,896,404 pwned addresses [1].
- Pwned Passwords sends only the first 5 characters of a password's SHA-1 hash, and a 'no pwnage found' result does not necessarily mean a password is good [4].
- After a breach involving your password, change it for the affected company and for any accounts using a similar password, and turn on multi-factor authentication [3].
- Since 21 September 2018, a US federal law has made credit freezes free to place, ending fees in states that previously charged them, and a bureau must place one within one business day if asked online or by phone [5]; the FTC says placing and lifting a freeze is free [9].
- IBM's 2026 report puts the global average breach cost at $4.99 million, but that is a cost to organisations, not to individuals [6].
- HIBP deliberately includes unverified and fabricated breaches [2], so treat a listing as exposure rather than proof of a hacked account.
On this page 14 sections
- Was my data leaked? How can I check?
- Is Have I Been Pwned safe and trustworthy?
- What does 'pwned' mean, and what do my results mean?
- How do I check if my password has been leaked?
- What should I do first after a data breach?
- Should I freeze my credit or place a fraud alert after a breach?
- How can I tell if my email was hacked or only leaked?
- Who pays when a breach happens, and what do the cost figures mean?
- What are the benefits and limits of breach-checking services?
- What happens next, and what is still uncertain?
- Common mistakes
- Frequently asked questions
- Glossary
- Sources
Was my data leaked? How can I check?
A data breach is, in the wording of Have I Been Pwned (HIBP), an incident where data is inadvertently exposed in a vulnerable system, usually through insufficient access controls or security weaknesses in the software [2]. HIBP aggregates breaches so people can see where their personal data has been exposed [2]. The fastest way to find out whether your data was leaked is to search your email address there.
As of 3 November 2026, HIBP's home page lists 1,048 pwned websites and 17,846,896,404 pwned addresses [1]. The public search returns results for only one email address or username at a time [2]. Searching a whole domain is a separate feature that requires you to verify that you are authorised to access that domain [2].
Why can a breach be missing from my results?
HIBP treats some breaches as 'sensitive'. Only the verified owner of an email address can see them, by signing in to the dashboard and confirming they can receive email at that address [2]. HIBP lists 90 sensitive breaches, including Ashley Madison and Adult FriendFinder (2015 and 2016) [2]. A plain search therefore does not show everything that may involve your address.
Does a clean result mean my data is safe?
No. HIBP says its search covers most breaches, while sensitive ones need sign-in [2]. In this guide's inference, a breach that has not been loaded into the service cannot show up at all. For passwords, HIBP says a 'no pwnage found' result does not necessarily mean it is a good password, merely that it is not indexed on the site [4]. Treat a clean result as one data point, and keep the basic protections in place regardless: unique passwords and multi-factor authentication.
Is Have I Been Pwned safe and trustworthy?
HIBP's design limits what it holds. When email addresses from a breach are loaded, no passwords are loaded with them; the separate Pwned Passwords service checks a single password against known breaches [2]. HIBP states that no password is stored next to personally identifiable data and that every password is SHA-1 hashed [2]. Public search is limited to one address at a time [2].
What does HIBP itself warn about?
HIBP acknowledges that users cannot be certain it is not harvesting the email addresses people search for, states that it is not, and tells anyone concerned about its intent or security not to use it [2]. Readers should weigh that candid warning against the service's stated purpose as a free risk-assessment service [2].
What does this guide not cover?
This guide does not describe who funds or operates HIBP or whether it has been independently audited. Read the site's own About page and decide whether you are comfortable. If you are not, the protections in later sections work without any checker: unique passwords, multi-factor authentication and, for US residents, a credit freeze.
What does 'pwned' mean, and what do my results mean?
'Pwned' began in video game culture as a leetspeak variant of 'owned', and it implies someone has been controlled or compromised [2]. On HIBP, though, a listing means your data was exposed somewhere. In this guide's reading, it is not evidence that anyone has logged in to your accounts.
What do the breach labels mean?
- Sensitive: hidden from public search and visible only to the verified owner of the address [2].
- Unverified: the data is legitimate, but its origin is not proven beyond reasonable doubt [2].
- Fabricated: unlikely to come from the named site, but it contains real email addresses [2].
- Retired: permanently removed. HIBP lists 2 retired breaches, Ticketek and VTech, and a breach is typically retired when the data is not being traded or redistributed elsewhere [2].
HIBP still includes unverified and fabricated breaches because they contain real personal information [2]. A listing is therefore not proof that a specific company was hacked. HIBP notes that even fabricated data may still be sold or traded [2].
How do I check if my password has been leaked?
Pwned Passwords is HIBP's separate service that checks a single password against known breaches [2]. It uses k-anonymity: the password is hashed on your device, only the first 5 characters of the SHA-1 hash are sent to the API, and the comparison against the returned suffixes happens on your side [4]. HIBP says the service handles over 18 billion requests a month [4].
Why does a leaked password matter if the account is different?
Attackers use exposed email and password pairs to try to access victims' other accounts, a technique called credential stuffing [4]. That is why, when a breach involves your password, the FTC advises changing it on any accounts using a similar password [3]. HIBP also notes that NIST guidelines recommend checking passwords against previously breached datasets [4].
How do I use the result?
- Check a password you use, or have used, on the Pwned Passwords page.
- If it is found, stop using it everywhere and replace it with a unique password for each account. The FTC suggests considering a password manager [3].
- If it is not found, do not read that as approval: 'no pwnage found' does not necessarily mean it is a good password, merely that it is not indexed on the site [4].
What should I do first after a data breach?
The right steps depend on what was exposed. Work through the items that match your situation.
- Change the password. If the breach involved your password, immediately change it with the affected company and on any accounts using a similar password. Consider a password manager, and turn on multi-factor authentication (MFA), which can protect an account even if the password is exposed [3].
- If an online account was exposed. Log in and change the password, and the username if you can. If you cannot log in, contact the company to recover or close the account. Change the password anywhere else you reused it [7].
- If a Social Security number was exposed (US). Accept free credit monitoring if the company offers it, get free credit reports and look for accounts you do not recognise, and consider a credit freeze or fraud alert [8]. The FTC's data-breach guide points to annualcreditreport.com for free reports, says to at least consider a fraud alert if you decide against a freeze, and advises filing taxes early [7].
- Use the official tool. The FTC's IdentityTheft.gov/databreach gives steps based on the type of information exposed [7].
- If your data has been misused. Report it at IdentityTheft.gov [8], which offers a personalised recovery plan [5].
Reach these services by typing the address yourself rather than following links in an unexpected message about a breach.
Should I freeze my credit or place a fraud alert after a breach?
This section describes US rules. Since 21 September 2018, a US federal law has let consumers place credit freezes for free, ending fees in states that previously charged them [5]; the FTC says placing and lifting a freeze is free [9]. Readers elsewhere should check their own country's credit and identity-protection rules, which this guide does not cover.
What is a credit freeze?
A credit freeze lasts until you lift it and does not affect your credit score [9]. While it is in place, nobody, including you, can open new credit; you can temporarily lift it to apply for credit, a job, a rental or insurance [9]. The FTC says a freeze will not affect your ability to apply for a job, rent or buy insurance [10], and calls it the best way to protect against someone opening new accounts in your name [10]. You must ask all three nationwide bureaus (Equifax, Experian and TransUnion). A bureau must place the freeze within one business day if you ask online or by phone, and lift it within one hour [5]. Parents can also freeze the credit of children under 16 for free [5].
What is a fraud alert?
A fraud alert needs a request to only one bureau, which notifies the other two [5]. The 2018 law extended the alert from 90 days to one year [5]. A standard alert lasts one year and is renewable for free, and an extended alert for identity-theft victims lasts seven years [10][9]. It does not limit access to your credit report [10].
Which one should I choose?
The FTC's data-breach guide says that if you decide against a freeze, you should at least consider a fraud alert [7]. The advice points one way: a freeze gives more protection, and a fraud alert is the lighter fallback. If your own country has no equivalent, the password and MFA steps still apply.
How can I tell if my email was hacked or only leaked?
A leak and an account takeover are different events. A leak means a third party exposed data in a vulnerable system [2]. An account takeover means someone logs in as you. In this guide's reading, a breach checker answers the first question, not the second, because a listing shows exposure rather than a login by someone else.
How does a leak turn into a takeover?
Mainly through reuse. Attackers use exposed email and password pairs to try to access victims' other accounts [4]. If you reused the password, change it everywhere it was used [7]. The FTC says MFA can protect an account even if the password is exposed [3].
What if I can no longer log in?
Contact the company to recover or close the account [7]. Signs of takeover differ from service to service, so this guide does not list them; check the service's own account-activity and security pages. If your data has been misused, report it at IdentityTheft.gov [8], which offers a personalised recovery plan [5].
Who pays when a breach happens, and what do the cost figures mean?
Breach-cost headlines describe what incidents cost organisations, not what they cost you.
IBM's 2026 Cost of a Data Breach Report puts the global average breach cost at $4.99 million. It is based on breaches at 602 organisations between March 2025 and February 2026, in a study run by the Ponemon Institute and sponsored and analysed by IBM [6]. The same release says one in four malicious breaches was AI-enabled [6].
The 2025 edition found the global average cost fell 9% to $4.44 million from $4.88 million [12], the first decline in five years [11][12], while the average US breach cost reached a record $10.22 million [11].
How should I read these numbers?
These are Ponemon Institute studies of organisations, not of individual victims [6]. Each edition has its own sample, so treat the move from $4.44 million to $4.99 million as context rather than a precise trend. None of the figures is a loss you should expect personally. For individuals, the practical response is the set of steps in the sections above.
What are the benefits and limits of breach-checking services?
Benefits
- A free, quick answer about where your address was exposed, across 1,048 listed websites as of 3 November 2026 [1].
- Passwords are kept apart from email addresses: none is loaded with them, and none is stored next to personally identifiable data [2].
- Sensitive breaches are shown only to the verified owner of the address [2].
- Password checks send only the first 5 characters of a SHA-1 hash [4].
Drawbacks
- HIBP says its search covers most breaches, and sensitive ones need sign-in verification [2].
- Some listings are unverified or fabricated, so a hit does not prove a particular company was hacked [2].
- HIBP says you cannot be certain it is not harvesting searched addresses, though it states that it is not [2].
- A password 'not found' result does not necessarily mean the password is good [4].
A checker is useful for deciding which passwords to change first. In this guide's view, it cannot replace habits such as unique passwords and MFA; the FTC advises turning on MFA and suggests considering a password manager [3].
What happens next, and what is still uncertain?
The headline counters are live: the 17,846,896,404 addresses across 1,048 websites shown on 3 November 2026 will not match what you see later [1]. On the cost side, IBM's average moved from $4.88 million [12] to $4.44 million in its 2025 report [11][12] and then to $4.99 million in 2026 [6]. One in four malicious breaches in the 2026 study was AI-enabled [6]. These figures do not settle whether AI-enabled attacks will keep raising costs.
What this guide cannot tell you
- How often leaked credentials lead to account takeover. No sourced figure is given here.
- Rules outside the US. Breach-notification rights and credit protections in other countries are not covered.
- Access from Iran. No reliable source was available on whether breach checkers, password managers or MFA apps can be reached or paid for from Iran, so no claim is made. Readers there can still apply the password and MFA steps, while the credit-bureau steps apply only to US credit files.
Because HIBP's totals change, searching again after news of a new breach is a cheap habit.
| Label | What it means | How HIBP handles it |
|---|---|---|
| Sensitive | Breach hidden from public search; HIBP lists 90 of them [2] | Visible only to the verified owner of the address after dashboard sign-in [2] |
| Unverified | Legitimate data, but origin not proven beyond reasonable doubt [2] | Still included because it contains real personal information [2] |
| Fabricated | Unlikely to come from the named site, but contains real email addresses [2] | Still included because it contains real personal information [2] |
| Retired | 2 breaches, Ticketek and VTech, permanently removed [2] | Typically retired when the data is not being traded or redistributed elsewhere [2] |
| Feature | Credit freeze | Fraud alert |
|---|---|---|
| Bureaus to contact | All three: Equifax, Experian and TransUnion [5] | One bureau, which notifies the other two [5] |
| Cost | Free to place and lift [9]; free to place under federal law since 21 September 2018 [5] | Standard alert is renewable for free [10] |
| Duration | Until you lift it [9][10] | One year as a standard alert [5]; seven years for an extended alert for identity-theft victims [10][9] |
| Access to your credit report | Restricted [5]; the FTC calls a freeze the best way to protect against new accounts in your name [10] | Not limited [10] |
| Report | Global average cost | US average cost | Basis |
|---|---|---|---|
| IBM Cost of a Data Breach 2025 | $4.44 million [11][12], down 9% from $4.88 million [12] | $10.22 million, a record [11] | Cost to organisations; first global decline in five years [11][12] |
| IBM Cost of a Data Breach 2026 | $4.99 million [6] | Not stated in the sources used here | 602 organisations, March 2025 to February 2026; Ponemon Institute study [6] |
Common mistakes
Treating a clean result as proof that nothing was leaked
Fix: Treat a clean search as one data point. HIBP says a 'no pwnage found' password result does not necessarily mean it's a good password, only that it is not indexed on the site [4]. Keep the basic protections in place either way: the FTC advises turning on MFA and suggests considering a password manager for unique passwords [3]. HIBP says its search covers most breaches and sensitive ones need sign-in [2], so a breach that was never loaded into the service cannot appear (this guide's inference).
Changing only the breached account's password and leaving reused ones alone
Fix: If the breach involved your password, change it for the affected service and for any accounts using a similar password, and turn on multi-factor authentication [3]. Attackers use exposed email and password pairs to try other accounts [4].
Assuming a listing proves your account was hacked, or that the named company was breached
Fix: Read the listing as 'your data was exposed', not 'my account was hacked' or 'this company was definitely hacked'. HIBP includes unverified and fabricated breaches because they contain real personal information, and notes that even fabricated data may still be sold or traded [2].
Stopping at passwords when sensitive identity data was exposed
Fix: If a Social Security number was exposed, US readers can accept free credit monitoring, pull free credit reports and consider a credit freeze or fraud alert [8]. The FTC's data-breach guide points to annualcreditreport.com for free reports, says to at least consider a fraud alert if you decide against a freeze, and advises filing taxes early [7].
Mixing up a fraud alert and a credit freeze
Fix: A freeze needs requests to all three bureaus and restricts access to your report, while a fraud alert needs one request [5]. An alert does not limit access to your credit report, and the FTC calls a freeze the best way to protect against new accounts being opened in your name [10].
Reading breach-cost headlines as what a breach will cost you personally
Fix: IBM's averages describe costs to organisations in studies run by the Ponemon Institute, not losses to individuals [6]. Use them only as context.
Frequently asked questions
How do I check if my email has been in a data breach?
Search the address on Have I Been Pwned, which returns results for one email address or username at a time [2]. As of 3 November 2026 the service lists 1,048 pwned websites [1]. Sensitive breaches appear only after you sign in to the dashboard and confirm you can receive email at that address [2]. A clean result is not proof of safety.
Is Have I Been Pwned safe?
HIBP says no password is stored next to personally identifiable data and every password is SHA-1 hashed [2]. It acknowledges that users cannot be certain it is not harvesting searched email addresses, states that it is not, and tells anyone concerned about its intent or security not to use it [2]. Decide whether that trade-off suits you; the protections in this guide work without any checker.
What does pwned mean?
'Pwned' began in video game culture as a leetspeak variant of 'owned' and implies someone has been controlled or compromised [2]. On HIBP, a listing means your data was exposed in a breach, usually through insufficient access controls or software weaknesses [2]. In this guide's reading, it does not show that anyone has logged in to your accounts.
What should I do if my email was in a data breach?
If the breach involved your password, change it with the affected company and on any accounts using a similar password, and turn on multi-factor authentication [3]. Consider a password manager [3]. If an online account was exposed and you cannot log in, contact the company to recover or close it [7]. Match further steps to the type of data exposed.
Does a data breach mean my account was hacked?
Not necessarily. HIBP defines a breach as data exposed in a vulnerable system [2]; exposure alone, in this guide's reading, is not a login by someone else. Attackers can use exposed email and password pairs to try other accounts, a technique called credential stuffing [4]. If you reused the password, change it everywhere [7]. If you see misuse, report it at IdentityTheft.gov [8], which offers a personalised recovery plan [5].
What is the difference between a fraud alert and a credit freeze?
A freeze needs requests to all three bureaus (Equifax, Experian, TransUnion) [5] and lasts until you remove it [9][10]. A fraud alert needs one request, which notifies the other two, and a standard alert lasts one year [5]; it is renewable for free [10]. The FTC calls a freeze the best way to protect against new accounts being opened in your name, and notes that an alert does not limit access to your report [10].
Are my passwords stored on Have I Been Pwned?
When email addresses from a breach are loaded into HIBP, no passwords are loaded with them [2]. The separate Pwned Passwords service checks one password at a time; it hashes it on your device and sends only the first 5 characters of the SHA-1 hash [4]. HIBP says no password is stored next to personally identifiable data [2].
What is a sensitive breach on Have I Been Pwned?
A sensitive breach is one HIBP hides from public search. Only the verified owner of the email address can see it, by signing in to the dashboard and confirming they can receive email at that address [2]. HIBP lists 90 sensitive breaches, including Ashley Madison and Adult FriendFinder (2015 and 2016) [2].
Glossary
- Data breach
- An incident in which data is inadvertently exposed in a vulnerable system, usually through insufficient access controls or software weaknesses.
- Pwned
- Slang that began in video game culture as a leetspeak variant of 'owned', used by HIBP to mean your data appears in a known breach.
- Credential stuffing
- Using exposed email and password pairs to try to log in to a victim's other accounts.
- Multi-factor authentication (MFA)
- A login method that asks for something more than a password, which can protect an account even if the password is exposed.
- SHA-1 hash
- A one-way scrambling of a password into a fixed string, used by HIBP so passwords are not stored in readable form.
- k-anonymity
- A technique where only the first 5 characters of a password's hash are sent to a service, so the full password never leaves your device.
- Credit freeze
- A restriction on access to your credit report that lasts until you lift it and helps stop new credit being opened in your name.
- Fraud alert
- A notice on your credit file, placed through one bureau, that lasts one year as a standard alert and does not limit access to your credit report.
Sources
- Have I Been Pwned: Check if your email address has been exposed in a data breach Have I Been Pwned (Troy Hunt); live page, retrieved 2026-11-03
- Have I Been Pwned: Frequently Asked Questions Have I Been Pwned; live page, retrieved 2026-11-02
- Have you been affected by a data breach? Read on US Federal Trade Commission (Consumer Advice)
- Pwned Passwords Have I Been Pwned; live page, retrieved 2026-11-03
- Starting Today, New Federal Law Allows Consumers to Place Free Credit Freezes And Yearlong Fraud Alerts US Federal Trade Commission · 2018-09-21
- IBM Study: One in Four Malicious Breaches are AI-Enabled, Costing Companies $6 Million on Average IBM Newsroom (Cost of a Data Breach Report 2026, Ponemon Institute) · 2026-07-29
- Data Breaches: What to know, What to do US Federal Trade Commission
- What To Do After a Data Breach US Federal Trade Commission (Consumer Advice)
- Credit Freezes and Fraud Alerts US Federal Trade Commission (Consumer Advice)
- Is a credit freeze or fraud alert right for you? US Federal Trade Commission (Consumer Advice)
- Average global data breach cost now $4.44 million Help Net Security (reporting IBM Cost of a Data Breach Report 2025) · 2025-08-04
- 2025 Cost of a Data Breach Report: Navigating the AI rush without sidelining security IBM X-Force
