5 Signs Your Data Is Already Leaked Online

In June 2025, cybersecurity researchers uncovered a searchable database containing over 16 billion leaked credentials, aggregated from infostealer malware across roughly 30 datasets. Platforms affected included Google, Apple, and Facebook. The people whose passwords appeared in that file had no idea.

That is how data leaks work. There is no alarm, no notification, and no obvious moment when it happens. Your email address or Social Security number quietly gets added to a list somewhere, and your first clue is often a fraudulent charge or an account you can no longer access.

According to the Identity Theft Resource Center, the U.S. recorded a record 3,322 data compromises in 2025 alone, a 79% increase over five years. And organizations take an average of 204 days just to detect a breach, let alone notify you.

These five signs can help you catch a leak before it causes serious harm.

Sign 1: You Are Receiving Unexpected Emails, Texts, or Password Reset Requests

A sudden spike in spam is easy to dismiss. It is also one of the earliest signs that your contact information is circulating somewhere it should not be.

When your email address ends up in a breach, it gets sold to spam networks almost immediately. If you are suddenly receiving phishing attempts, promotional emails from services you have never heard of, or texts asking you to verify accounts you do not recognize, your data is likely already in criminal hands.

Password reset emails you never requested are a particularly clear signal. In early 2026, thousands of Instagram users received unsolicited reset requests after attackers exploited a flaw to trigger them at scale. Instagram confirmed external parties were sending reset emails, meaning stolen credentials were being actively tested against real accounts.

Pay attention to messages that reference your real name, physical address, or partial account numbers. Generic spam does not have that detail. Personalized phishing does, and it means someone has a fuller picture of who you are.

What to do

• Check your email at Have I Been Pwned, the most widely used free breach-checking tool, updated continuously with new leak data.
• Enable spam filtering and mark suspicious messages as phishing, not just spam, so your provider can improve detection.
• Never click links in unexpected messages, even if the sender name looks familiar.

Sign 2: Your Passwords Stop Working on Accounts You Did Not Change

Being locked out of an account you use regularly, with no action on your part, is one of the clearest indicators that someone else has been in.

Attackers who obtain credentials from a breach often run credential stuffing attacks, automated scripts that test stolen username and password combinations across hundreds of platforms. If you reuse passwords across accounts, a single breach can cascade into multiple compromised logins.

Credential abuse is now the leading initial access method in breaches globally. Verizon’s 2025 Data Breach Investigations Report found credentials were involved in 22% of all breaches reviewed, ahead of vulnerability exploitation and phishing.

What to do

• Change the password on any affected account immediately, using a unique string you have not used anywhere else.
• Turn on two-factor authentication everywhere it is available. Even with your password exposed, 2FA blocks most unauthorized access attempts.
• NIST’s Digital Identity Guidelines now recommend long, unique passphrases over complex but reused passwords. A password manager makes this practical.

Sign 3: Unfamiliar Financial Activity Appears on Your Accounts or Credit Report

The U.S. recorded 3,322 data breaches in 2025, the highest number ever reported. Cyberattacks caused 80% of them, and the primary target in most cases was personally identifiable information: Social Security numbers, bank account details, and dates of birth.

Small, unfamiliar charges are frequently how financial fraud surfaces first. Attackers test stolen card details with minor transactions before moving to larger ones. A charge of a few dollars from an unfamiliar processor, especially from abroad, should prompt an immediate review of all recent activity.

More serious signs include new credit inquiries from lenders you have never contacted, unfamiliar accounts appearing in your credit history, or a sudden unexplained drop in your credit score. These indicate someone is using your identity to open new lines of credit.

In the United States, you are entitled to one free credit report per week from each of the three major bureaus through AnnualCreditReport.com. Checking it every few months takes under five minutes and is one of the most reliable early-warning tools available.

What to do

• Place a credit freeze with all three major bureaus. It is free, does not affect your existing credit or score, and prevents new accounts from being opened in your name.
• Dispute any unauthorized accounts or inquiries directly with the bureau reporting them.
• Report identity theft to the FTC at IdentityTheft.gov, which generates a personalized step-by-step recovery plan.

Sign 4: A Company You Use Sends You a Breach Notification

Under laws like the California Consumer Privacy Act and dozens of state-level breach notification statutes, companies in the U.S. are legally required to notify users when a breach exposes their personal information. If you receive one, take it seriously even if the language sounds measured.

Breach notifications frequently understate the risk. Phrases like “out of an abundance of caution” or “no evidence of misuse” are standard legal hedging, not a guarantee your data is safe. What matters is the category of information that was exposed.

To put the scale in perspective: in 2025 alone, Yale New Haven Health agreed to an $18 million settlement after a breach affecting 5.6 million patients. Earlier in 2026, NYC Health + Hospitals confirmed 1.8 million people had data copied by an attacker who had been inside their network for over two months undetected, including biometric fingerprints and palm prints.

Exposed email addresses and names carry moderate risk. Exposed passwords, Social Security numbers, financial account details, or medical records carry significantly higher risk and warrant immediate, not eventual, action.

What to do

• Read the notification carefully and note exactly what type of data was involved.
• Change passwords on any account where you used the same credentials as the breached service.
• If Social Security numbers or financial data were included, place a credit freeze and notify your bank proactively before waiting for suspicious activity.

Sign 5: Your Information Shows Up in a Breach Checker or Dark Web Scan

The most direct way to confirm your data has been exposed is to check it yourself. Have I Been Pwned now indexes over 12 billion records from publicly disclosed breaches. Entering your email address takes seconds and returns exactly which breaches included it and what data was in each one.

Dark web monitoring tools from Google, Norton, Experian, and others scan underground forums and marketplaces for your email address, phone number, or financial identifiers. As security researchers note, these tools do not cover everything since only indexed portions of the dark web are visible. But a positive result is a reliable indicator that your data is actively being traded.

One critical nuance: receiving an alert about a “past breach” is not a glitch. Once a dataset is leaked, it enters a recycling cycle, getting aggregated with other breach data, repackaged, and redistributed across new forums. An alert for a breach from two years ago means that data is still in active circulation today.

People-search sites like Spokeo and Whitepages are also worth checking. If you find details you have never publicly shared, such as a previous address, a phone number you use only for private contacts, or family member names, that information has been sold or leaked from a data broker.

What to do

• Check all your email addresses at Have I Been Pwned, including old ones you no longer actively use.
• Set up free dark web monitoring through Google One or your bank if offered, then review any alerts that come in rather than dismissing them.
• Submit opt-out requests to major data brokers. Services like DeleteMe automate this process across dozens of brokers simultaneously.

What to Do If You Confirm a Leak

Finding out your data has been exposed is unsettling, but it is not a reason to panic. The volume of stolen credentials circulating at any given time is so large that attackers work through lists gradually, not instantly.

The priority order is straightforward. Secure your email account first, since it is used to reset every other account. Enable two-factor authentication across all important accounts. Check your credit and, if sensitive financial or government ID data was involved, place a freeze immediately.

FTC’s IdentityTheft.gov provides step-by-step recovery guidance tailored to the specific type of information that was compromised, whether it is a credit card number, a Social Security number, or medical records. It is the most reliable starting point for anyone navigating a confirmed breach.

Data breaches are not going away. The U.S. alone saw a record number of incidents in 2025, and 2026 is tracking similarly. What you can control is how quickly you spot the signs and how fast you act on them.

Frequently Asked Questions