A breach exposure result is one of the easiest to misread. It does not mean your systems were compromised, or that ours were. It means an address of yours appeared in a publicly disclosed leak from somebody else's service — the forum you signed up to in 2014, the vendor that lost a database last year.
What matters is not the count. It is which types of data each leak contained.
What the check receives, and what it does not
ClickScan receives only the list of data types each breach contained. Never the data itself, and never your password. There is nothing to steal from us, because we never hold it.
The check requires proven ownership of the mailbox — you cannot point it at a stranger's address — and costs three credits.
Why the data types are the whole story
Two breaches is not a number that tells you anything on its own. The report separates them by what was exposed:
- A password. The serious one, and the reason credential stuffing works. Attackers take username-password pairs from one breach and try them everywhere else, at scale. If that password was reused anywhere, those accounts are already open — not at risk of being opened.
- Personal details. A phone number, a date of birth, a home address. Nothing to log in with, but exactly what makes a phone call or an email sound informed. Most successful social engineering is not clever; it just knows things it should not.
- An email address alone. Worth knowing, worth very little on its own.
The date on the answer
Every breach lookup records when the breach data it consulted was retrieved, and the report shows it. A breach corpus is a reference list like any other, and ClickScan's rule holds here: a list we did not write ourselves carries its source, its age and how far it is trusted, and that limit is applied where the grade is computed rather than at display time — so an exported report carries it too.
An absence of results means nothing was found in the data we consulted, as of that date. It does not mean an address is clean. Any tool implying otherwise is overselling.
What to do about it
Change the password on every service named, and anywhere you reused it. Turn on two-factor authentication wherever it is offered — it is what makes a leaked password insufficient on its own. Use a different password per service, so one breach stays contained. And treat unexpected messages that reference exposed details as suspicious, because that is what makes a scam sound informed.
Every new account gets free starter credits. Start at app.clickscan.ai, or see everything ClickScan checks.