Skip to main content

Breach Check

Breach Check is a one-off check of a single email address against known data breaches. It answers one question: has this address been exposed? It is the quickest way to look up an address without setting anything up, and it is included in the free level of Kiren.

It is separate from continuous monitoring of personal data. Breach Check looks once and reports what it finds; it does not keep watching the address afterward and sends no alerts. To be told about new breaches as they appear, the address needs to be added as a watched item. With Kiren Plus this can be done straight from the result. See Monitoring personal data.

Breach Check is opened with the Breach Check quick action on the You screen.

Running a check

  1. The screen is headed "Breach check" and reads "Check your email for breaches".
  2. Enter an address in the "Email" field. Any address can be checked, not only the one used to sign in.
  3. Tap Scan for breaches. The button stays inactive until the address is complete and valid.
  4. The screen changes to "Checking for breaches..." while the check runs. Cancel stops it and returns to the start.

Reading the result

The result screen is headed "Results". The count in the title covers recent breaches, meaning those from the last 12 months. Older breaches are listed separately further down.

  • No breaches: a green icon with "All clear" and the line "We haven't found any breach with this email at this moment."
  • Breaches found: a red icon with "We found # recent breach." or "We found # recent breaches.", followed by the list. When every breach found is older than 12 months, the title reads "We found 0 recent breaches." and the findings appear under "Older breaches".

Each row in the list shows a summary of what was exposed, such as email, password, username, address, phone number, or name, together with the breach name, its date, and a severity badge reading Critical, Moderate, or Minor. The most serious findings are listed first. The rows cannot be opened; the full details of a breach and the steps to take about it are shown for watched items in Monitoring personal data.

Older findings are grouped in a collapsible "Older breaches" section. It opens expanded only when there are no recent breaches. A note explains that these breaches are old and should no longer have an effect, but that it is worth double-checking that the affected accounts were updated at the time.

What else the screen offers depends on the subscription level:

  • On the free level, the result notes that reviewing the breaches and taking action is part of Kiren Plus.
  • With Kiren Plus, the recent findings are listed under "# Breaches (Last 12 months)", and an Add to personal data watch button adds the address as a watched item, where each breach can be opened and worked through. If the address is already being watched, the button opens its existing detail screen instead.

The back arrow returns to the start for a new check. When the result calls for no action, a Check another email button at the bottom does the same.

If the address is not the user's own

Any address can be checked, including someone else's. To stop a stranger's breaches from counting against the user's own protection status, the result screen shows a card headed "If this is your email, add it to Personal Data Watch" with a Not my email checkbox. Ticking it changes the card to "Not your email" with the note that this will not affect the security status, and the check no longer counts anywhere in the app. The choice cannot be undone, and the address can no longer be added to personal data watch from this result.

Marking breaches as resolved

When the check finds at least one recent breach rated Moderate or Critical, an I've resolved these breaches myself button appears. It is for the case where the affected accounts have already been dealt with, for example by changing the passwords. A dialog asks "Are you sure you resolved the breaches?" and reminds the user to confirm only if the breached information is no longer in use anywhere. Tap Mark as resolved to confirm, which returns to the start screen, or Cancel to go back.

A resolved check counts as safe in the protection status shown on the Overview and You screens. Checking the same address again keeps the resolved mark unless the new check finds more breaches than before.

Recent checks

Earlier checks are listed under "Recent checks" below the input. Each row shows the address, partly hidden, when it was checked, a badge that is red if that check found a recent Moderate or Critical breach and green otherwise, and a status line: "Review needed", "Resolved by you", or "All clear". A check marked Not my email has no status line. A check whose only findings were Minor or older than 12 months counts as clear here, even though the result screen listed them.

The list is not shown while a check is running or while a result is on screen, and it does not appear at all before the first check.

Tapping a row does not reopen the old result. It runs the check again for that address and shows a fresh one. Results can change between checks, because new breaches keep being discovered and published.

The three-dot More options menu on a row offers Delete, which removes the entry from the list.

If the check does not complete

A message appears above the button explaining what went wrong. Most of these are temporary and running the check again is enough, for example "The scan took too long. Please try again." when the check timed out, "We couldn't check this email. Please try again.", or "The service is busy right now. Please try again." when the service is under load.

A few need something more than a retry. "No internet connection. Try again." means the device has no working connection, which Breach Check needs. "Your session has expired. Please sign in again." means signing in again is needed before the check can run.

A note on the results

A clear result means the address has not been found in the breaches known at the time of the check. It is not a guarantee that it has never been exposed: breaches are often discovered and published long after they happen, and some are never published at all. This is why watching an address continuously is more useful than checking it once.