Have I been affected by a data breach?

Start with two sources

Check your email against known breach records and look for an official notice from the organization involved. These answer different questions: a database can show a recorded email match, while a company notice can explain whether a particular incident involved your information.

You do not need to complete our contact form to read these guides or browse the public breach catalogue.

Check your email in known records

Use the email address associated with the affected service. If you used more than one address, check each separately. Our checker uses Have I Been Pwned (HIBP) and shows the breach records returned for the address you enter.

A match is a starting point, not proof of identity theft or a legal claim. Review the company name, incident date, and reported data categories. Never enter your account password into our checker.

We store submitted search details and a result summary. Read our privacy details before searching.

Look for an official company notice

Visit the company’s website independently and look for a security or incident notice. Compare its dates and description with any letter you received. If it is unclear whether you were affected, contact the company using a verified contact channel.

A breach listed in the news does not mean every customer was affected. A vendor incident may also involve information from another organization you recognize.

No match does not mean no exposure

HIBP does not contain every breach. Some incidents are not publicly available, have not been added, or are excluded from public searches. A no-match result should not override a verified notice saying your information was involved.

A reported category, such as phone numbers, also does not establish that every affected person lost that particular type of information.

Choose your next step

If you have a notice, use our letter guide to organize the details. If you want to discuss your circumstances, you can submit an optional intake. An email match by itself does not establish eligibility for compensation.