Breach Radar: the latest data breaches, and a private password check

The newest verified breaches loaded into Have I Been Pwned, refreshed about hourly — and a way to see whether a password has already leaked without it ever leaving your browser.

By the CyberTechVault editorial team, NorwegianSpark SA · Updated 28 September 2026

Breach Radar

Latest breaches added to Have I Been Pwned

Live

Breach data: Have I Been Pwned (CC BY 4.0) —haveibeenpwned.com· newest additions first, verified breaches only.

Has my password been leaked?

Your password never leaves this browser. It is hashed here (SHA-1) and only the first 5 characters of that hash are sent to Pwned Passwords by Have I Been Pwned; the match happens on your device. We do not log, store or track it.

The fix for a leak

A leaked password is only dangerous where it is reused. A password manager gives every account its own; breach monitoring tells you when to change one.

Our pickNordPassPassword manager that creates a unique password per account, with a built-in data-breach scanner.Get NordPass
AlternativeAvast BreachGuardData-breach monitoring that scans the dark web for your personal details.See Avast BreachGuard

Paid links — we may earn a commission, at no extra cost to you. Prefer free? Bitwarden's free plan does the core job too; it is not one of our partners.

How the breach list works

The list comes from Have I Been Pwned's public breach API. We show the breaches it added most recently, which is not the same as the date a breach happened — a leak can surface years after the fact, so each row shows both. We only list breaches HIBP marks as verified, and leave out the ones it flags as sensitive, fabricated, spam lists or retired. Nothing is added, estimated or rewritten: if the feed cannot be reached, the panel says so and shows nothing.

How the password check stays private

It uses the k-anonymity model built into Pwned Passwords. Your browser turns the password into a SHA-1 hash, sends only the first five characters of that hash, and gets back every leaked hash that starts the same way — hundreds of them, padded so the reply size gives nothing away. The comparison with the rest of your hash happens on your device. The password itself, and its full hash, are never sent, logged or stored.

A "not found" result means that exact password is not in the list. It does not mean the password is strong, and it says nothing about your email address.

If a password shows up

Change it on every account where you used it, starting with email and banking.
Give each account its own password — a password manager makes that practical.
Turn on two-factor authentication wherever it is offered.

Choosing a manager? Our best password managers 2026 guide compares the field, including free options we earn nothing from.

Sources

Breach data: Have I Been Pwned, licensed under Creative Commons Attribution 4.0 — haveibeenpwned.com
API terms and k-anonymity range search: haveibeenpwned.com/API/v3

How the breach list works

How the password check stays private

A "not found" result means that exact password is not in the list. It does not mean the password is strong, and it says nothing about your email address.

If a password shows up

Change it on every account where you used it, starting with email and banking.

Give each account its own password — a password manager makes that practical.

Turn on two-factor authentication wherever it is offered.

Choosing a manager? Our best password managers 2026 guide compares the field, including free options we earn nothing from.