Your Personal Data May Already Be for Sale Online
Every year, billions of records containing email addresses, phone numbers, hashed passwords, and credit card details are stolen from corporations and then sold in underground dark web marketplaces and hacker forums. Major breaches affecting Indian users have included data from food delivery platforms, telecom operators, healthcare portals, and e-commerce marketplaces. The unsettling reality is that your personal information could already be circulating in breach dump databases without your knowledge. Here is a comprehensive guide on how to check if you are compromised, what to do, and how to minimize future exposure.
Step 1: Use HaveIBeenPwned to Check Your Email
HaveIBeenPwned (HIBP), maintained by Australian security researcher Troy Hunt, is the most trusted free data breach notification service globally. To check your exposure status:
- Open Chrome on Android and visit
haveibeenpwned.com. - Enter your primary email address in the search field and tap pwned?
- The service cross-references your email against a database of over 13 billion leaked records. It returns a full list of every breach database in which your email appeared, along with the exact data types compromised—passwords, dates of birth, phone numbers, or payment methods.
Step 2: Check If Your Passwords Are in Breach Databases
HIBP also provides a Pwned Passwords tool allowing you to verify whether a specific password has been exposed in known breach dumps—without transmitting the actual password. It uses a k-anonymity SHA-1 hash model: the password is hashed locally on your device and only the first 5 characters of the hash are queried, so your real password never leaves your phone.
Step 3: Enable Google Password Checkup on Android
Android’s built-in Password Checkup feature (Settings > Passwords > Check passwords) automatically audits your saved credentials against Google’s continuously updated breach intelligence database. It flags passwords that are confirmed compromised, duplicated across multiple websites, or structurally weak. Tapping any flagged entry opens a direct update shortcut to the affected website.
Immediate Actions After Discovering a Breach
- Change the compromised password immediately on the affected website and on every other service where you reused that same password.
- Enable two-factor authentication (2FA) using an authenticator app on the breached service to prevent unauthorized access even if the password is known.
- If financial data was exposed in the breach, contact your bank immediately to freeze card transactions and request a replacement card number.
For more cybersecurity awareness guides, data breach response plans, Android privacy tools, and protection tips, visit Android People.