You use strong passwords, you don’t click on suspicious links, and you keep your antivirus updated. You are practicing good digital hygiene. But what happens when the massive corporations storing your data get hacked?
Every year, billions of user records—including emails, phone numbers, and plaintext passwords—are stolen from platforms like LinkedIn, Canva, and Adobe. These lists are dumped onto dark web forums, allowing hackers to run automated scripts to break into your other accounts. If you reuse passwords across different sites, a breach on a small forum could compromise your primary bank account.
Here is how you can check if you are a victim, completely for free.
Enter “Have I Been Pwned”
Created by Troy Hunt, a Microsoft Regional Director and cybersecurity expert, HaveIBeenPwned.com (HIBP) is the industry-standard database for tracking compromised data. It is entirely safe to use and does not store your searches.
How to run a security check:
- Navigate to haveibeenpwned.com.
- Type your most frequently used email address into the search bar and hit Enter.
- The Green Screen: If the screen turns green with the text “Good news—no pwnage found!” your email has not been identified in any known public data breaches.
- The Red Screen: If the screen turns red, scroll down. The site will provide a detailed list of exactly which corporate data breaches included your information and what specific data (e.g., passwords, IP addresses, phone numbers) was leaked.
Checking specific passwords
HIBP also has a “Passwords” tab in its top navigation menu. You can type in a password you frequently use. The database will return a number indicating exactly how many times that specific password has been seen in data breaches. If the number is anything above zero, it is no longer safe to use.
What to do if you are “pwned”
If your email appears in a breach, don’t panic. Take immediate action:
- Change your passwords: Immediately change the password for the breached site and any other site where you used that exact same password.
- Enable 2FA: Turn on Two-Factor Authentication for your critical accounts (email, banking, social media).
- Scan for local threats: Data breaches often lead to targeted phishing emails and tracking cookies. Running a deep privacy scan using a tool like Outbyte AVArmor can help ensure your local machine isn’t being silently tracked or compromised by adware that slipped through the cracks.
Stop relying on the security of the weakest website you visit. Check your exposure today, and start using a password manager.