How to Find Out If Your Data Was in a Breach

The fastest ways to find out if your data was in a breach are to search your email address in a reputable breach lookup service, check the breach notice databases that several state attorneys general publish, and search your inbox and mail for notification letters. None of these is complete on its own, so using a few together gives you the clearest picture.

1. Search your email in a breach lookup service

Free services such as Have I Been Pwned collect data from breaches that have been leaked publicly and let you search by email address. If your address appears, you will see which breaches it was found in and what types of data were included.

These services are good at catching breaches of online accounts, such as websites and apps. They are less useful for breaches at hospitals, employers or banks, where the stolen data is often never published in a searchable form. A clean result does not mean you were never affected.

2. Check state attorney general breach lists

Many state laws require companies to report breaches to the state attorney general when residents are affected, and several states post those reports online. Searching them by company name can tell you whether a business you deal with had a breach, when it happened and, sometimes, what kind of data was involved. Coverage and detail differ from state to state.

3. Check the federal list for health data

Under HIPAA, health care providers, health plans and their business partners must report breaches affecting 500 or more people to the US Department of Health and Human Services, which publishes them on a public portal. If you have seen a doctor, lab or insurer that had a breach, it may be listed there.

4. Search your own inbox and mail

• ✓Search your email for phrases like "notice of data", "security incident" and "data breach".
• ✓Check spam and promotions folders, where these emails often land.
• ✓Look for letters from companies you do not immediately recognize. Breaches at vendors, such as billing companies or labs, are often announced by a firm you never dealt with directly.

5. Pull your credit reports

Your credit reports will not tell you about a breach, but they will show whether someone is using your information. You can get free reports from each of the three nationwide bureaus through AnnualCreditReport.com, the site authorized by federal law. Look for accounts, inquiries or addresses you do not recognize.

6. Check the settlements themselves

Data breach settlements usually describe the class in plain terms, for example everyone who was notified that their information was involved in a specific incident. If you recognize a company in a list of open data breach settlements, read the eligibility section. Some settlement sites have a lookup tool, or you can contact the administrator to ask whether you are on the class list.

What to do if you find a match

1. 1Note the company name, the date of the breach and the type of data exposed.
2. 2Change the password for that account and anywhere you reused it.
3. 3If a Social Security number or financial data was involved, consider a credit freeze.
4. 4Save any notice you received and start a simple log of time and costs, in case a settlement follows.

The guide to breach notice letters covers the next steps in more detail.

Why you may not have been told

Notification laws apply to certain kinds of data, such as Social Security numbers or financial account numbers, and the exact list differs by state. A breach involving only an email address may not trigger a letter at all. Companies also rely on the address they have on file, so a letter sent years after you moved can simply disappear.

Breaches at vendors add another layer. If a hospital's billing contractor is hacked, the notice may come from a company you never heard of, and it is easy to throw away. That is one more reason to check the sources above instead of waiting for mail.

Breach lists show you what happened in the past. To find out when a breach turns into a payout, add the companies, hospitals and employers you use to SettleScout. It will flag matching settlements and remind you before each claim deadline.