About the Breach Directory & Exposure Timeline
Every known data breach, searchable by the company involved or by what actually leaked. For each one: when it happened, how many accounts it took, which data classes were exposed — and the number nobody publishes, the disclosure lag.
That gap is the point of this tool. The catalogue records both the date a breach occurred and the date it became public knowledge, and the distance between them is routinely measured in months or years. Across the full catalogue the median is around four months, roughly a third of breaches took over a year to surface, and the worst ran past fourteen years. For that entire window the data was in circulation and the people in it did not know. Seeing the lag laid out changes how you think about the advice “change your password when you hear about a breach”.
The second half is the part most breach sites skip: what to actually do, broken down per data class. A leaked password, a leaked date of birth and a leaked national identity number each demand a completely different response, and only one of them can be fixed by changing something. Data comes from the Have I Been Pwned breach catalogue, cached daily. Nothing you search is stored, and no email address is ever asked for — this searches breaches, not people.
Mark the services you actually hold accounts with — use the Add to my profile button on any breach below. Your list is stored in this browser only; it is never sent anywhere.
How to Use the Breach Directory
Search a company name or domain to pull every recorded breach involving it, or leave the search empty and use the data-class filter to answer the opposite question — which breaches exposed bank account numbers? Sorting by longest cover-up first is the most revealing view in the tool. Open any result to see its timeline and, underneath, specific instructions for each type of data it exposed.
The Gap Between Breach and Disclosure
Two dates are recorded for every breach: when it happened, and when it became public. The distance between them is the number that should shape your habits, because for that entire period the data was being traded while the people in it carried on unaware. Across the catalogue the median gap runs to several months, roughly a third of breaches took more than a year, and the extreme cases stretch past a decade — data stolen before some of the affected accounts’ owners had smartphones.
That has a blunt implication. Reacting to breach news is always too late. By the time you read a headline, the credentials have been through months of credential-stuffing runs. The only defences that work are the ones already in place before disclosure: a unique password per site, so one leak cannot travel; a second factor, so a leaked password is insufficient; and a password manager, because unique passwords are impossible to maintain by memory. Everything else is cleanup.
Not All Leaked Data Is Equal
The most useful way to read a breach record is by data class, because the correct response differs enormously and only some of it is fixable.
- Changeable. Passwords, security questions and API tokens. Rotate them and the exposure genuinely ends. Do it everywhere you reused them, not just at the breached site.
- Replaceable, with friction. Payment cards, phone numbers, email addresses. You can get a new one, but it costs you time and every service you use has to be updated.
- Permanent. Date of birth, national identity numbers, mother’s maiden name, biometrics, medical history. These cannot be rotated. Once out, they stay out, which is why a breach containing them justifies a credit freeze rather than a password change — the defence has to move to detecting misuse instead of preventing exposure.
- Reputationally sensitive. Dating profiles, health conditions, political or religious affiliation, sexual orientation. No technical remedy exists. What matters here is knowing it happened, so that a blackmail attempt referencing it does not land as a surprise.
Why a Leaked Password Hash Is Still a Leaked Password
Breach notices often reassure that “passwords were encrypted”. Read that carefully. If the passwords were stored with bcrypt, Argon2 or heavily iterated PBKDF2, a strong password is genuinely still safe. If they were stored as unsalted MD5 or SHA-1 — which is what a great many older breaches in this catalogue used — a modern GPU recovers the great majority of them in hours. “Hashed” is not a synonym for “safe”; it is a question about which algorithm, and the answer is usually buried or absent. Assume the worst and rotate.
You can see the scale of that difference for a specific password with the Password Strength & Crack-Time Estimator, which also checks it against 900 million passwords recovered from these very breaches.
What to Do in the First 48 Hours
- Change the password at the breached service, then everywhere you reused it. Reuse is the mechanism that turns somebody else’s incident into yours.
- Revoke active sessions. Look for “sign out of all devices” in security settings. A stolen session cookie keeps working after a password change until you do.
- Add a second factor, choosing a passkey or authenticator app over SMS, which is defeated by SIM swapping.
- Audit the account’s recovery settings. Check for unfamiliar recovery email addresses, phone numbers, forwarding rules and connected apps. Quietly adding one of these is how an intruder keeps access after you have changed the locks.
- If identity data leaked, freeze your credit at the reporting bureaus. It is free, it is reversible, and it blocks the main way permanent identity data gets monetised.
- Expect targeted phishing. Breach data is what makes a scam message convincing: the real order number, the real last four digits, the real account name. Treat any message that knows too much about you with more suspicion, not less — you can check a suspicious link with our Scam & Phishing Link Analyzer.
Where This Data Comes From, and What It Does Not Cover
Records come from the Have I Been Pwned breach catalogue, the reference public index maintained since 2013, cached here for a day at a time. Two honest limitations. First, it contains only breaches that have surfaced — the ones still sitting undisclosed are by definition absent, and the disclosure-lag numbers above suggest there are always some. Second, this tool deliberately does not check individual email addresses: that requires a paid commercial key and would mean collecting your address. If you want a per-address check, do it directly at Have I Been Pwned, which offers it free on its own site.
Browse every Security & Privacy tool for more.
Frequently Asked Questions
How long does it usually take for a data breach to become public?
Far longer than most people assume. Across the whole catalogue the median gap between a breach happening and it surfacing publicly is roughly four to five months, and around a third of all recorded breaches took more than a year to come to light. The longest in the catalogue ran to more than fourteen years. Throughout that gap the data is circulating and being used, while the people in it have no idea.
What should I do first if a service I use has been breached?
Change that password immediately, then change it anywhere else you reused it — the reuse is what turns one company's failure into your problem. Next, sign out of all active sessions in the account's security settings, because a stolen session token survives a password change. Then turn on two-factor authentication, preferring a passkey or an authenticator app over SMS. Only after those three steps is it worth worrying about the rest.
Does this tool check whether my email address was in a breach?
No, and deliberately so. Checking an individual address requires a paid commercial key from Have I Been Pwned, and it would mean collecting your email address. This tool searches the catalogue of breaches themselves — which companies, when, how many accounts and exactly what data classes. Nothing you type is stored, and no email address is requested at any point.
Why does a breach from years ago still matter?
Because the data does not expire. Your date of birth, national ID number and mother's maiden name are permanent, so a 2013 breach containing them is as useful to a fraudster today as it was then. Passwords matter for as long as you keep reusing them, and old breach corpora are exactly what credential-stuffing attacks are run from. The only categories that genuinely age out are payment cards, which get reissued, and session tokens.
What is the difference between a verified and an unverified breach?
A verified breach is one where the data has been confirmed as genuine and attributable to the named service, usually by matching records against people who confirm the details are theirs. Unverified entries are circulating data sets whose origin is claimed but not proven — they may be real, repackaged from other breaches, or fabricated. Around 96 percent of the catalogue is verified. Treat unverified entries as worth acting on but not worth panicking over.
