An example: Aoife checks after a breach notice
Fictional example: Aoife in Galway reads that an online garden shop has lost customer data. A breach check she opens herself shows her address in two old breaches. Because she once used the same password for her email, she changes that one first, signs out other devices and turns on two-factor authentication. A later message ‘about your data breach’ with a login link goes unanswered; she checks the shop's app directly.
Which check services can you trust with your address?
A check service compares your address with data from breaches that are already known. The Swiss Federal Office for Cyber Security (BACS) points to the data leak check on iBarry, the internet security platform of the Swiss Internet Security Alliance. Germany's Federal Office for Information Security (BSI) lists the leak checkers of the Hasso Plattner Institute (HPI) and the University of Bonn.
| Service | How you get the result | What you learn | Named or used by |
|---|---|---|---|
| iBarry data leak check | Query based on Have I Been Pwned data | Whether and when your data appeared in a leaked data set | Swiss BACS |
| Have I Been Pwned | In the browser; sensitive breaches only after you verify the address by email | Which breaches the address appears in | Data source for iBarry |
| HPI Identity Leak Checker | Reply email to the address you checked | Which types of data were affected | German BSI |
According to its privacy notice, the HPI service sends its answer as a reply email, so only someone with access to the inbox sees it. Have I Been Pwned shows results straight away and says searches are not logged. The French data protection authority CNIL, by contrast, advises against websites that claim to hold leaked data and suggests asking the organisation concerned.
Tip: An email address is all a breach check needs. Open the service yourself and never type a password into a ‘leak check’ page that reached you through an email or an advert.
What does a match mean, and what does it not mean?
A match means your address is in at least one known leaked data set. It does not mean someone is in your account right now. Have I Been Pwned calls a listed breach an immutable historic fact: changing your password will not remove it. ‘No match’ is no guarantee either, because the services only know incidents they have already processed.
According to iBarry, login details are also spied on by malware. If you suspect malicious software, deal with it first: the BACS recommends updating your system and apps and scanning with up-to-date antivirus software.
In which order should you secure your accounts?
The CNIL advises starting with the most important services, such as email, banking, tax and online shopping. Email comes first because many password resets go through your inbox.
- Check your device and remove any malware.
- Email account: new, unique password, end all active sessions, check forwarding rules and recovery details.
- Every account with the same or a similar password.
- Accounts involving money. If a financial service is affected, the BACS advises contacting the provider immediately.
- Turn on two-factor authentication wherever it is offered.
- All remaining accounts, one by one.
If you reused one password widely, put your password changes in the right order. If you are locked out of your inbox, see Email account taken over? Check forwarding and connected accounts.
What should you do for each type of leaked data?
| Leaked data | What can happen | What you do |
|---|---|---|
| Password | Login attempts on other services | Replace it everywhere you used it |
| Email address, phone number | Realistic phishing emails, texts or calls | Do not reply or click; contact the company yourself |
| Name, address, date of birth | Identity misuse | Check statements; report misuse to the police |
| Bank or card details | Unauthorised payments | Tell your bank at once and have the card blocked |
The CNIL notes that fraudulent messages look realistic because they reuse leaked data; the BACS advises staying especially alert to targeted phishing in the weeks that follow. Check security emails in your account instead of its link.
Does the company have to tell you?
Under EU rules, a company must report a personal data breach to the national data protection authority, and inform you directly if it creates serious risks for your data or privacy, as the EU portal Your Europe explains. You can complain to your national authority, which replies within 3 months, and you may be entitled to compensation. Whether a claim fits your case is a question for individual advice.
In Switzerland, EU law does not apply automatically. Under Article 24 of the Federal Act on Data Protection (FADP), a company reports a breach to the Federal Data Protection and Information Commissioner (FDPIC) as soon as possible if it is likely to result in a high risk. It informs you if this is necessary to protect you or if the FDPIC requests it.
| Country | Check or get information | Help and reporting |
|---|---|---|
| Germany | Leak checkers of HPI and the University of Bonn, listed by the BSI | Police, including the federal states' online reporting portals; regional consumer advice centres for support |
| Austria | Information from the company concerned (EU rules) | National data protection authority; police if your data is misused |
| Switzerland | iBarry data leak check, named by the BACS | Cantonal police, especially after financial loss or misuse (find a station via suisse-ePolice) |
| France | CNIL; cybermalveillance.gouv.fr for identity theft | Police or gendarmerie complaint |
| Italy | Garante per la protezione dei dati personali; companies notify it within 72 hours where possible | Complaint to the Garante as the national data protection authority |
| Spain | INCIBE helpline 017, free and confidential, daily 8:00 to 23:00 | Also WhatsApp 900 116 117 or Telegram @INCIBE017 |
Common mistakes
- Changing the password only at the breached service while using it elsewhere.
- Leaving the email account until last.
- Clicking a link in a message ‘about your data breach’.
- Reading ‘no match’ as an all-clear.
Your checklist
The checkboxes are for your own reference. No entries are sent to us. To keep a copy, print the page or save it as a PDF using your browser menu.
Common questions
Is it safe to enter my email address on a breach check site?
With the services named here, you only enter your address, never a password. The Hasso Plattner Institute says it stores requested addresses in a disguised form called a hash, and Have I Been Pwned says searches are not logged. Unknown sites that offer a leak check through an email or an advert deserve caution; open the service yourself.
I changed my password. Why does the service still show a match?
The service shows what was found in a past breach, not the current state of your account. Have I Been Pwned calls a breach an immutable historic fact, so a new password cannot remove the listing. What matters is that the old password is no longer used anywhere.
Can I check my parents' email address for them?
It works best together. The HPI service sends its reply to the address checked, and alerts from Have I Been Pwned only go to the monitored address itself. Sit down with your parents at their own device and let them carry out the steps. Help someone online without collecting their passwords explains how.
Sources and further information
Primary sources from public authorities, consumer organisations and providers. A source may be in another language; follow the guidance that applies to your service and where you live.
- Have I Been Pwned: Frequently asked questionsSource review date:
- Hasso Plattner Institute: Identity Leak Checker privacy notice (German)Source review date:
- iBarry (Swiss Internet Security Alliance): Security checks including data leaksSource review date:
- Your Europe (EU): Data protection and online privacySource review date:
- BSI: Emergency plan for a hacked email account, help for victims (German)Source review date:
- Swiss Federal Office for Cyber Security: Account hacked (German)Source review date:
- FDPIC: Guide on reporting data security breaches under Art. 24 FADPSource review date:
- CNIL: Data leak or theft, how to know if you are affected (French)Source review date:
- Garante Privacy: Personal data breaches (Italian)Source review date:
- INCIBE: Cyber security helpline 017 (Spanish)Source review date:
