Sometimes a website or app you've signed up to gets hacked, and the details it holds about you get stolen. This is called a **data breach**. It happens to big, well-known companies as well as small ones, and there's nothing you could have done to stop it. Breach detection checks whether any of your email addresses were caught up in a hack like that, and tells you which sites to change your password on. It's off by default, and you can switch it on from the [Spam Blocker page](https://app.leavemealone.com/spam-blocker). ## What we check We check every email address on your Leave Me Alone account. That's the address you log in with, plus every email account you've connected. To do the check we send those email addresses to [Have I Been Pwned](https://haveibeenpwned.com), a well-known and trusted service that keeps a list of known hacks. We don't send anything else. Have I Been Pwned only tells us which hacks included your address. It never tells us, or anyone else, your passwords. :::info We only send your addresses while breach detection is switched on. If you'd rather we didn't, leave it off and nothing is sent. ::: ## Turning it on 1. Go to the [Spam Blocker page](https://app.leavemealone.com/spam-blocker). 2. Scroll to the bottom, to the **Breach detection** section. 3. Switch the toggle to **Enabled**. We'll start checking straight away. It usually takes a few minutes, and once it's done you'll see how many hacks we found under the toggle. A new **Breaches** tab also appears at the top of the page with the full list. ## Reading the results The **Breaches** tab lists every hack we know of that included one of your email addresses, newest first. For each one you'll see: * **The name of the site or service** that was hacked. * **Hacked**: roughly when the hack happened. * **Made public**: when the hack became known. Sometimes that's years later. * **Your email address in this hack**: which of your addresses was included. * **What was stolen**: the kinds of details taken, like email addresses, passwords, or phone numbers. Anything from the last year is marked **new**, and we'll also show it on your dashboard so you don't miss it. Some entries have an extra label, because not everything on the list is a hacked website: * **spam list**: a marketing company collected your email address to send spam, and their list leaked. There's no password to change, but you might see more junk mail. * **virus**: your details were taken by a virus on a computer you've logged in from, not from a website. Run a virus scan on your devices, then change your passwords once they're clean. * **unconfirmed**: Have I Been Pwned hasn't been able to confirm the hack is genuine. It's still worth changing your password there, just in case. Hover over a label to see this explanation in the app. Click any entry to see the full story: what happened, roughly how many people were affected, exactly which details were taken, and a link to read more on Have I Been Pwned. ## What to do if you've been found in a hack First, don't panic. This is very common. Most people who've used the internet for a few years show up in at least one hack, and it doesn't mean someone is in your email. Here's what to do: 1. **Change your password on the site that was hacked.** If you don't use that site any more, delete your account there instead. 2. **Change it anywhere else you used the same password.** This is the important one. Hackers try stolen passwords on lots of other sites, so a password you reused is the real risk. 3. **Turn on two-factor authentication** on your email account and any other important accounts, if you haven't already. It means a stolen password on its own isn't enough to get in. 4. **Be a bit more suspicious of emails** that mention the hacked site, especially ones asking you to log in or confirm details. Scammers use stolen email lists to send convincing fakes. You don't need to change your email address. Your address being in a hack just means it was on that site's customer list. It's the password that matters. :::tip A password manager makes all of this much easier. It creates a different strong password for every site and remembers them for you, so one hack can't unlock anything else. ::: ## How often we check * **When you switch it on.** Straight away. * **When you connect a new email account.** We check the new address as soon as it's added. * **Every week, on a paid plan.** New hacks come to light all the time, so we re-check all your addresses weekly and let you know if a new one appears. If you're on the free plan we only check when you switch it on or add an account. To get the weekly check, [upgrade your plan](https://app.leavemealone.com/spam-blocker/buy-plan?f=breach-monitoring&r=no-plan). ## Turning it off Go back to the **Breach detection** section at the bottom of the [Spam Blocker page](https://app.leavemealone.com/spam-blocker) and switch the toggle to **Disabled**. We'll stop checking and stop sending your addresses to Have I Been Pwned, and the Breaches tab will disappear. Switch it on again any time and we'll pick up where we left off. ## Getting your details off data broker sites Details stolen in a hack don't just sit there. They're often bought by **data brokers**, companies that collect your name, home address, phone number, and more, then sell it to anyone who asks. That's how your details end up on people-search sites, and it's one reason the scam calls and junk mail don't stop. You can ask each broker to remove you, but there are hundreds of them and they tend to put your details back after a while. Our partner [EasyOptOuts](https://www.easyoptouts.com/) does the removals for you, and repeats them every few months so you stay off. Leave Me Alone subscribers get **25% off EasyOptOuts for life**. Head to our [partners page](https://leavemealone.com/partners) to get the deal. It's for US customers only, as that's where EasyOptOuts operates. ## Common questions **Why are there hacks from years ago?** Have I Been Pwned keeps a record of every hack it knows about, going back more than a decade. Old hacks still matter if you're using the same password today, but if you've changed it since then, you're fine. **It says nothing was found, but I get lots of spam. Why?** Spam and hacks aren't the same thing. Your address can end up on spam lists in lots of ways without any site being hacked. The [Spam Blocker](https://app.leavemealone.com/spam-blocker) is the tool for that. **Does this check my passwords?** No. We never see your passwords for other sites, and we don't send any passwords to Have I Been Pwned. We only check email addresses. **Can I remove a hack from the list?** Not at the moment. The list is a record of what's known, so we leave it as it is. Once you've changed the password there's nothing more to do. If something doesn't look right, or you're worried about a hack you've been found in, [get in touch](https://app.leavemealone.com/settings/support) and we'll help. --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the search API with the q parameter: ``` GET https://help.leavemealone.com/api/search?q= ``` The query should be search terms that you're trying to find to answer your question. The response will contain relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.