Data breach check: how to see if your data was leaked

A breach check searches collections of data that has already leaked from other companies. When an organisation is compromised, the records taken often circulate publicly, and services such as Have I Been Pwned and Cybernews index those records so you can search them for your own identifiers.

That gives you one specific, useful fact: whether your email address or phone number appears in a known leak, and often what kind of data sat alongside it. What it does not give you is the thing most people actually want, which is a list of the accounts you hold that are now at risk. The database knows the breach; it does not know you.

In Australia, organisations covered by the Privacy Act must notify affected people about eligible breaches under the Notifiable Data Breaches scheme. That notification is worth acting on, but it only covers incidents that have been identified and reported, and it only reaches you if the company still has current contact details for you. Running your own check fills the gaps.

Start with Have I Been Pwned, the best-known free checker. You enter an email address and it returns the indexed breaches that address appears in, along with the categories of data exposed in each one. Checked in July 2026 it listed 1,019 breached websites and 17,708,582,733 accounts.

Three parts of it are worth knowing about:

• Email search is free and does not require an account. This is the check most people need.
• Notify Me emails you if your address turns up in a future breach, which converts a one-off check into an ongoing one.
• Pwned Passwords checks whether a specific password has appeared in a breach, without transmitting the password itself.

Paid tiers exist for people who want API access or domain-wide monitoring, starting at US$4.39 per month for the smallest Core plan (checked July 2026), but the search you came for is free. If you want the background on how the service works and what “pwned” means, see our Have I Been Pwned guide.

No breach corpus is complete. Each service collects what it can verify, from different sources, at different times, which is why two reputable checkers can disagree about the same address. The Cybernews personal data leak checker is a good second opinion, and unlike most email-only tools it also accepts a phone number in international format. Cybernews states it does not collect or store the email addresses entered.

The gap between those totals is the point, not a discrepancy to resolve. They are counting different collections, so a breach missing from one may be present in the other. Treat a positive result from either as real, and treat two clean results as encouraging rather than conclusive. If you want a wider set of options, our Have I Been Pwned alternatives guide compares the tools side by side.

This is the step people skip, and it is where a breach check becomes useful. A database can tell you that your address was in a particular leak. It cannot tell you that the leak was the streaming service you signed up to in 2019, forgot about, and reused a password on.

To close that gap manually:

1. List the breaches your check returned and note what was exposed in each, especially passwords, phone numbers and identity documents.
2. Work out whether you still hold that account. Searching your inbox for the service name is usually faster than trying to remember. Our guide on how to find accounts linked to your email covers the search terms that surface the most.
3. Check whether the password was reused anywhere. This is the single highest-value question, because credential stuffing is how one breach becomes five.
4. Close what you no longer use. A dormant account is still a place your data can leak from. See how to delete old accounts.

Finding your address in a breach is common and not a reason to panic. The short version, in priority order: change the password on the affected account and anywhere you reused it, turn on multi-factor authentication, and expect a rise in phishing that name-drops the breached company. Report anything that tries to defraud you to Scamwatch.

The full sequence, including what to do when the exposed data includes identity documents, is a guide of its own:

• What to do if your email is in a data breach is the step-by-step response plan.
• How to secure your email after a data breach covers hardening the inbox itself, which matters most because it controls password resets everywhere else.

If your check flagged a company by name, or you have simply seen one in the news, we maintain a per-incident guide for each major breach covering what was exposed, who was affected and the exact steps to secure that account. The full list lives at our breach guides index. Frequently searched ones include:

• Optus (2022) and Medibank (2022), the two incidents that reshaped Australian expectations about breach notification.
• Latitude Financial (2023) and Australian Clinical Labs (2022), both involving identity and health-adjacent data.
• Qantas (2025) and Tangerine (2024), two Australian consumer brands with large customer lists.
• MyDeal (2022), Crunchyroll (2026), Booking.com (2026) and Canvas / Instructure (2026), the kind of everyday consumer accounts a breach check most often surfaces.

If the breach that turned up is not on that list, the response steps are the same regardless of which company was involved.

A breach check is a snapshot of a moving target. The address that comes back clean today can appear in a corpus next month, and you will not know unless something is watching. Two low-effort habits close that gap:

• Subscribe to notifications.Have I Been Pwned's Notify Me is free and requires nothing beyond a confirmed email address.
• Shrink the attack surface. Fewer live accounts means fewer places to be breached from. Our digital footprint checklist is the shortest path through that, and password manager vs breach monitor vs digital footprint manager explains what each category of tool does and does not protect.

A public breach database answers “was this address in a leak”. In The Event Of is built to answer the follow-up question: which of your accounts does that actually affect, and what do you do about each one.

You connect a supported inbox, Gmail or Outlook, and it scans account-related metadata, sender addresses, subject lines, labels and timestamps, rather than the body of your emails. From that it builds a map of the services tied to your address, including the ones you had forgotten, and shows breach exposure against those real accounts with guided steps for each.

The free tier covers discovering linked accounts from a supported inbox, the footprint map, guided checklists, progress tracking, baseline breach checks and essential alerts. The paid Protection plan is A$10 per month or A$99 per year, with a 14-day free trial on the monthly option, and adds multiple email addresses, deeper breach detail, priority alerts, richer remediation guidance and continuous monitoring. You stay in control of every change.