Checking breach exposure without touching passwords

Data breaches are so common that the useful question is not whether an email address has been exposed, but where, when and what was exposed. There are two ways to answer it: look at the breach metadata, or look at the leaked content. This article argues for the first and explains why the second crosses a legal and ethical line.

Exposure versus secrets

Two things are often confused:

• Exposure: the name of the breach, its date, the affected company, the number of records and the types of data involved (emails, names, phone numbers, addresses, passwords).
• Secrets: the leaked values themselves. The password, its hash, security answers, session cookies.

An example: "this address appears in a 2019 breach of an online shop, which exposed emails, names and password hashes" is exposure. The hash itself, or any password someone has cracked from it, is a secret.

Exposure answers almost every legitimate question. Secrets add risk without adding anything a legitimate investigation needs.

What exposure is good for

• Self-audit. Knowing which of your accounts were affected, which passwords to change and where to turn on two-step verification.
• Organisational security. Seeing which corporate addresses appear in breaches, to prioritise training and credential resets through the company's own systems.
• Fraud prevention. Breach dates give a minimum age: an address that appears in a 2015 breach existed in 2015.
• Investigations. Breaches are points on an account's timeline, and the affected company is a pivot towards its infrastructure.

The sources

Have I Been Pwned

The service created by Troy Hunt lets you search for an email address on its website free of charge; searching through the API requires a subscription. Each breach has its own page with a description, date, number of accounts and data types. It also flags verified breaches, fabricated ones and spam lists, and it keeps breaches it considers sensitive, where merely appearing would reveal something intimate about the person, out of public search.

It also offers email alerts for your own addresses and a domain search for anyone who can prove they control the domain.

XposedOrNot

A free service with an API that returns, for an email address, the breaches it appears in, their dates, the types of data exposed, the industry of the breached company and an estimate of each breach's password risk, for example whether passwords were stored in plain text.

LeakCheck

Its public API returns the names and dates of the sources in which an email address or username appears, and which fields those sources contained, without the values. Pandora uses only that public API.

Each service has its own collection of breaches, so their results do not fully overlap. Combining them gives a more complete picture.

How to read a result

• Appearing in a breach does not mean someone got into your account. It means your data was held in a system that was compromised. The real risk depends on what leaked and on whether you reused the password.
• The breach date and the publication date are not the same thing: a breach can come to light years later.
• Data types tell you the risk. If passwords are listed, how they were stored matters: plain text is not the same as a strong hash.
• Verified or not. Some breaches are fabricated, and some compilations mix data from many sources. They carry less weight.
• Zero results does not mean zero exposure. It only means the address is not in the known breaches those sources have indexed.
• A breach's name can itself be sensitive. Appearing in a leak from a dating or health site reveals special category data. If your purpose does not require it, do not record it.

Why handling leaked credentials crosses a line

Some tools offer the full content of breaches, passwords included. Pandora does not, for five reasons:

1. Using a leaked password to get into someone else's account is unauthorised access, a criminal offence in Spain (Article 197 bis of the Criminal Code), in the UK under the Computer Misuse Act and in most other countries.
2. Downloading or storing breach dumps means processing stolen personal data at scale, with no lawful basis to support it.
3. Whoever keeps dumps becomes the next breach. Those files end up copied and resold.
4. Infostealer logs are even more invasive: they contain session cookies and passwords saved on infected computers. Pandora does not query the search engines that index them.
5. It adds nothing legitimate. Some people match repeated passwords or hashes to link accounts belonging to the same person. It sometimes works, but it relies on data stolen from the victims.

The line holds with paid providers too: from those queried through their APIs, Pandora reads only metadata (source, date and data types), never the content of a breach.

How Pandora does it

For an email address, Pandora queries XposedOrNot, LeakCheck's public API and, with a key, Have I Been Pwned. It merges the results by breach name and shows, for each one, its date, the data types, the number of records and which source reports it. The affected company can be added to the graph as a domain, so you can pivot to its infrastructure, and breaches appear on the timeline alongside account sign-ups.

Each breach is an entity in the graph, linked to the address, so if several addresses in a case appear in the same breach, you can see it at a glance. That does not make them related: large breaches contain millions of accounts.

For a username, LeakCheck's public API shows which sources it appears in as a login name.

At no point are passwords, hashes or other leaked values requested or displayed.

What to do if your address shows up

1. Identify the service and the date of each breach.
2. If passwords were included, change the one for that service and for anywhere else you reused it.
3. Use a password manager and turn on two-step verification wherever you can.
4. Check your own passwords without exposing them. The Pwned Passwords service uses a k-anonymity model in which only the first five characters of the password's SHA-1 hash are sent, and several password managers build it in. Never paste a password into a website you do not know.
5. Be wary of messages that use exposed details, such as your phone number or home address, to look legitimate.
6. Sign up for Have I Been Pwned alerts for your addresses.

In an organisation: from a list to a plan

For a company, the exposure of its corporate addresses is useful security information, provided it is handled without looking for someone to blame:

1. Get the list through the intended channel. Have I Been Pwned lets anyone who proves they control a domain search all the addresses on it, and other services offer similar monitoring.
2. Sort by risk. First, breaches that included passwords; then those that exposed phone numbers or postal addresses, which feed phishing and phone fraud.
3. Act through your own systems. Force password resets in your identity provider, require two-step verification and check whether corporate addresses are being used for personal services.
4. Communicate without pointing fingers. Appearing in a breach is rarely the employee's fault: it happened to a service they used.
5. Repeat the review regularly. New breaches keep being published.

Legal and ethical note

Even a third party's exposure metadata is personal data. Check only the addresses your purpose justifies, do not turn a list of breaches into a profile of the person, and take particular care with breaches whose name reveals sensitive information.

This article is not legal advice.