How do I check if my email was leaked in a data breach?

The best-known free tool is Have I Been Pwned (haveibeenpwned.com). Type your email address and it lists the known breaches that included it, along with what kind of data leaked, such as passwords, phone numbers or addresses. Check every email you use, including old ones. A clean result only means your email is not in the breaches that site knows about, not that you have never been exposed.

Can I check if my phone number was leaked?

Partly. Have I Been Pwned can search some phone numbers, but only for the few breaches where numbers were loaded in a searchable way, so a "not found" result proves very little. For Indian users it is safer to assume your mobile number is already on scam lists and to treat every unknown caller who asks for an OTP, PIN or app install as a scammer.

What should I do first if my password was leaked?

Change it on that site, then on every other account where you used the same or a similar password, starting with your email, because email can reset everything else. Turn on two-factor on those accounts and use "sign out of all devices" where it is offered. A password manager makes giving each account its own password practical.

My Aadhaar details may have leaked. What can I do?

You cannot change your Aadhaar number, but you can limit misuse. Through the official myAadhaar portal on uidai.gov.in or the official mAadhaar app you can lock your biometrics and see your authentication history. Share a masked Aadhaar where a full copy is not required, never share the OTP sent to your Aadhaar-linked number, and check your credit report for loans you did not take.

Is paid breach monitoring worth it?

It is optional. Free checks like Have I Been Pwned and the password checkups built into Google, Chrome and Apple are enough to start. Paid monitoring, often bundled with a password manager, adds automatic alerts when your details show up in new leaks. It can tell you about a leak; it cannot stop one or undo it.

Was My Data Leaked? How to Check Your Email, Phone and Passwords, and What to Do Next

You get a call. The person knows your full name, the city you live in, and that you ordered something online last week. They say they are from your bank's KYC team and your account will be blocked today. Because they know so much, it feels real.

That detail almost certainly came from a data breach, not from your bank. This guide explains what a breach is, what leaked data is actually used for in India, how to check whether your email, phone number or passwords are out there, and what to do if they are, including the steps that only apply here, like Aadhaar and credit reports.

What a data breach is, and why it reaches you

A data breach is when a company's customer records are stolen or exposed. It might be an online store, a food delivery app, a travel site, a job portal, a lab or clinic's booking system, or a small forum you joined in college. The data usually includes some mix of names, emails, phone numbers, addresses, dates of birth and passwords, sometimes properly protected, sometimes not.

The important part: you did not have to do anything wrong. You did not click a bad link or install a strange app. You simply signed up somewhere, maybe years ago, and that company's systems were broken into or left open. The data then gets sold, traded or dumped online, and it can circulate for years.

So the useful question is not "will my data leak?" but "which of my details are already out there, and how do I make them useless?"

What leaked data is used for in India

Leaked data rarely means someone is reading your files. It means scammers have better ammunition. The common uses:

What leaked	How it gets used
Name, phone number, city	Targeted calls and WhatsApp messages that greet you by name, so you trust them faster
Phone number and the company you used	Fake KYC, refund or delivery calls pretending to be that company or your bank
Phone number plus date of birth or address	OTP fraud and SIM-swap attempts, where someone tries to get a duplicate SIM or talk you into reading out a code
Email and password	Password reuse attacks: the same login tried automatically on Gmail, Instagram, Amazon and banking sites
ID numbers or document scans	Fake loan or SIM applications, or more convincing impersonation

The biggest trick is psychological. Most people think "they know my name, my address and what I bought, so they must be genuine". Leaked data is exactly what makes that untrue. A caller knowing your details proves only that your details leaked.

For the full playbook on OTP and SIM-swap scams, see our UPI, OTP and SIM-swap scam guide.

How to check if your data was leaked

1. Have I Been Pwned (free)

Have I Been Pwned (haveibeenpwned.com) is the best-known free breach-checking site, run by an independent security researcher and widely used by security professionals.

Email check: type each email address you use, including old Yahoo, Rediffmail or college ones. It lists the known breaches that included that email, and what kind of data was exposed in each (passwords, phone numbers, addresses and so on).
Alerts: you can sign up, free, to get an email if your address turns up in a breach the site adds later.
Phone numbers: the site can search some phone numbers, but coverage is partial. Only a few breaches had their numbers loaded in a searchable way, so "not found" for your number proves very little.

Two limits to keep in mind. A clean result only covers breaches the site knows about; plenty of leaks never become public. And a hit does not always mean your password leaked. Read what data that breach included before you panic.

2. The password checkup you already have

You probably already have a tool that checks your saved passwords against known leaks:

Google Password Manager / Chrome: open Google Password Manager (in Chrome's settings, or on Android under your Google settings) and run Password Checkup. It flags passwords that have shown up in leaks, are reused, or are weak.
iPhone, iPad and Mac: open the Passwords app (or Settings → Passwords on older versions) and look at Security Recommendations, with detection of compromised passwords switched on.
Other browsers and password managers usually have a similar "password health" or "compromised passwords" section.

These tools are designed to check without sending your actual password in readable form. Do not type your real passwords into random "check your password" websites; stick to the tools built into your browser, phone or password manager.

3. Paid breach monitoring (optional)

Some password managers add breach monitoring: they keep watching for your email and other details in new leaks and alert you automatically, usually alongside a password health check. Dashlane is one paid example. It is a convenience, not a requirement; the free checks above cover the basics.

If you appear in a leak: what to do

Work through these in order. The first three take about 15 minutes for most people.

Change the leaked password, then every place you reused it. Start with your email account, because email is how every other account resets its password. Then banking, UPI app logins, Amazon and Flipkart, social media. Each account should get its own password. If that sounds impossible to remember, that is exactly what a password manager is for; our password manager guide covers a 15-minute setup.
Turn on two-factor (two-step verification) on email, your Google or Apple ID, social media and anything with money in it. An authenticator app or passkey is stronger than SMS where it is offered.
Sign out of other sessions. Google: myaccount.google.com → Security → Your devices. WhatsApp: Settings → Linked devices. Instagram and Facebook: Accounts Centre → Password and security → Where you're logged in. Remove anything you don't recognise.
Check email forwarding and recovery details. In Gmail settings on a computer, make sure no forwarding address has been added, and confirm the recovery phone and email are yours.
Expect smarter phishing for a while. If a breach exposed your name and number, the calls and messages that follow will sound informed. Don't click links in "your account will be blocked" messages, and call your bank only on the number printed on your card or shown in its official app.
Tell your family about the "knows my name" trick. Parents especially tend to trust a caller who knows personal details. One sentence helps: "If anyone knows our name and asks for an OTP, PIN or app install, it's a scam, just hang up."

If you notice OTPs you never asked for or logins from devices you don't own, also run the checks in our guide to checking whether your phone is hacked.

India-specific steps

Lock your Aadhaar biometrics

If your Aadhaar number or a scan of your card may have leaked, you cannot change the number, but you can limit how it is used. UIDAI lets you lock your biometrics (fingerprint and iris) so they can't be used for authentication until you unlock them yourself. You do this through the myAadhaar portal on uidai.gov.in or the official mAadhaar app, using an OTP sent to your Aadhaar-linked mobile number. The same official routes let you view your authentication history, which shows when your Aadhaar was used to verify you.

Rules that matter:

Use only uidai.gov.in or the official mAadhaar app from the Play Store or App Store. Search ads and WhatsApp links promising "Aadhaar lock" can lead to fake sites.
Never share the Aadhaar OTP with anyone who calls you, whatever they claim. UIDAI does not call to ask for it.
Where a full copy is not required, share a masked Aadhaar, which hides most of the number.

Steps and menu names change from time to time, so follow the instructions on the official site rather than a screenshot in a forward.

Check your credit report for loans you didn't take

Leaked ID details are sometimes used to apply for loans, credit cards or "buy now, pay later" accounts in someone else's name. The way to catch this is your credit report. India has several credit bureaus, including TransUnion CIBIL, Experian, Equifax and CRIF High Mark, and you are generally entitled to a free full report from each one once a year. Check each bureau's official website for how to request it.

Look for loans, cards or enquiries you don't recognise. If you find one, raise a dispute with the bureau and inform the lender in writing.

Check the SIMs in your name

The government's Sanchar Saathi portal and app let you see the mobile connections registered in your name and report any that aren't yours. It takes a couple of minutes and is worth doing after any ID leak.

Report fraud quickly

If money is lost or a fake account is opened, call your bank's fraud line first, then the national cyber fraud helpline 1930, and file a complaint at cybercrime.gov.in. With money, speed matters. If leaked details are being used to threaten you over private photos or videos, that needs a different response; see our sextortion guide.

What you cannot fix

Some leaked things can't be taken back:

Your phone number stays leaked. Changing numbers is a big disruption and rarely worth it. Instead, treat every unknown caller with caution: no OTPs, no PINs, no screen-sharing apps, no "verification" payments.
Your name, date of birth and address stay leaked. Assume a scammer may know them, and never accept them as proof that a caller is genuine.
Your Aadhaar number can't be changed. That is why the biometric lock and OTP discipline matter.

What you can fix is everything protected by a password, and how you react to calls. That is where your effort pays off.

Do this today: a 15-minute checklist

Check every email you use on Have I Been Pwned, and sign up for its free alerts.
Run Password Checkup in Google Password Manager or Chrome, or Security Recommendations in Apple Passwords.
Change any leaked or reused password, email account first.
Turn on two-factor for email, your Google or Apple ID, and banking.
Sign out of devices you don't recognise on Google, WhatsApp and Instagram.
If your Aadhaar may be exposed, lock biometrics via uidai.gov.in or the official mAadhaar app.
Put a reminder in your calendar to request your free annual credit report.
Send your family one message: "Knowing our name doesn't make a caller real. Never share an OTP."

The bottom line

Your data leaking is usually not your fault, and often not something you can undo. What you control is whether that leak leads anywhere. Give every account its own password, turn on two-factor, keep the Aadhaar OTP and your PINs to yourself, and stop trusting callers just because they know your name. Do the checks once now, then again whenever you hear about a big leak at a service you use.