Exposure means data about you was copied from a service. What matters is whether the copied material can still be used to get into an account.
Breach data gets treated as a verdict. It is not. It is a record that some service once lost a set of data that included an address, and sometimes much more than that.
The useful reading is about reuse: a leaked password reused elsewhere is live danger; a leaked email address on its own is mostly an invitation to more targeted mail.
Sorting what you find
- A leaked password: change it at that service and everywhere it was reused, today.
- A leaked password hash: assume the password is known, especially if it was short or common.
- Leaked personal facts — date of birth, address, security answers: change anything that uses them for verification.
- The address alone: expect targeted messages that reference the breached service by name, and treat all of them as suspicious.
- Card details: replace the card rather than watching transactions.
Where the data comes from
Breach-exposure data on this site comes from public and licensed sources: XposedOrNot for email monitoring, and Pwned Passwords, operated by Have I Been Pwned, for the password check. Each is credited alongside its data, as its licence requires. Password checks send only a partial hash: the full password is never transmitted and never stored.
What to do next, in order
- 1Change the password on the account's email address first, since it can reset everything else.
- 2Change the exposed password wherever it was reused, starting with anything holding money.
- 3Turn on two-factor authentication, so an exposed password alone stops being enough.
- 4Change exposed security answers, which are reused even more often than passwords.
- 5Check an address here whenever you want the current picture, and read the reasons rather than the count.
Frequently asked questions
Is one breach record a problem?
Only if what leaked is reusable. The record itself changes nothing about your security; the decision it should trigger is which password or which answer to change.
Why does my address appear in several breaches?
Because it has been used at many services over many years, and services lose data at different times. The count is less important than whether the same password was reused across them.
Does checking my password here expose it?
No. Only a partial hash is sent, which is enough to check against the database and not enough to recover the password. The password itself never leaves your device and is never stored.
Written by The BaitScan team
Last updated September 16, 2026
Results are automated risk estimates based on public indicators and heuristics.