What a breach entry shows
Every breach, wherever it is opened from, shows the same four fields.
- Severity: how serious the exposure is, shown as Critical, Moderate, or Minor.
- Data exposed: the list of information that was leaked, such as full name, email, phone number, password, username, address, or date of birth.
- Service: the site or service the data came from. It reads "Combo list" when the data comes from a collection compiled from several different breaches, and "Unknown" when the source cannot be named.
- Date: when the breach happened or was published.
A combo list is worth understanding. It is not a single company that was hacked, but a compilation of data from many breaches shared as one file. Because it points at no single service, the useful response is to make sure passwords are unique everywhere rather than to contact one provider.
Working through a new breach
A newly found breach opens as a short guided flow.
- The first screen reports the finding, with a line such as "We found a breach with your data." Tap Let's handle this.
- "What's at risk for you" explains what the leaked information can be used for, one card per type of data. A leaked password, for example, is explained as something criminals can use to log in immediately and will try on other services; a leaked date of birth as something commonly used to answer security questions. Tap Show me what to do.
- The checklist has two sections. Do these now holds the actions worth taking straight away, each confirmed with I have done this. Good to know holds advice for the longer term, each confirmed with Got it. Completed items are marked Done.
- Tap Mark as reviewed when finished. The last screen reads "You handled this!" and notes that watching continues. From there, Go to breach list returns to the list and Review again reopens the breach.
Typical actions in Do these now are changing the password and changing it everywhere it was reused, enabling two-factor authentication, contacting the card issuer or the bank, watching for unfamiliar transactions, contacting the passport authority, blocking an ID number with the bank, and reporting suspected fraud to the police. Typical Good to know advice covers being alert to phishing that follows a breach, using an authenticator app rather than SMS codes, using virtual card numbers when shopping, limiting where personal details are shared, and setting up transaction alerts.
Reviewing a breach from the list
Tapping a breach in the list opens the review screen, headed "Breach found" with the line "We found your data in a breach." It shows the same severity, data exposed, service, and date, the same explanation of what is at risk, and the same checklist. Mark as reviewed moves the breach into the "Reviewed breaches" section.
A breach that has already been reviewed opens headed "Reviewed breach". Its checklist items are all shown as done and cannot be changed. The breach stays available to read at any time.
Marking a breach as reviewed only changes how it is filed in the app. It does not remove the leaked data from anywhere, and monitoring of the detail continues.
If a breach cannot be opened, the screen shows "We couldn't load this breach. Please try again." or "This breach is no longer available."
Leaked passwords
When a password was part of the leak, it is shown in a card of its own, hidden behind a Show password button. Tapping it reveals the password, and it hides itself again automatically after a short time.
Seeing the password is useful for one thing: recognizing which password it is. Every account using it can then be changed. It should not be reused anywhere after this point. If the leak contained an encrypted password, it is still worth changing. Encryption can be broken over time, especially for short or common passwords.
If the details are hidden
Breach details for an email address or phone number are only shown once ownership of it has been confirmed. Until then, the breach shows a banner reading "Verify to see the full details." with a Resend verification email or Resend verification phone button. The severity, data exposed, service, and date card is still shown, but Data exposed usually reads "Unknown".
Verifying the address or number unlocks the full details, including what was exposed and the steps to take. See Monitoring personal data for how verification works.
If a breach still shows limited information even though every affected email address and phone number is verified, the screen reads "We're still confirming the details of this breach. Check back shortly." This resolves on its own; nothing needs to be done.