Your email breach history is every known breach your address has turned up in, year by year, with what leaked each time. Sort it oldest first and you’re looking at the accounts you opened, used for a bit, and forgot about.
Most of those accounts are still open. Some of the sites aren’t.
One hour, one list. Read it, sort it, close what you can, lock what you keep. Every number here is dated and sourced, and the tool it runs on is free.
A quick word on who’s writing. I run XposedOrNot, a free, open-source breach checker: type in an email, see which public breaches it’s in, no signup, nothing stored. The first-party numbers below come from our catalog of 790 breaches, pulled on 9 October 2026, and the outside numbers come from peer-reviewed studies, standards bodies and government reports, linked at the end.
Three numbers before you start
| The number | What it means for your list |
|---|---|
| Nearly 40% of the accounts a typical person ever created are now unused, about 53 per person (CHI 2026 study, April 2026) | Your list is longer than you think. Most people in the study underestimated theirs. |
| 530 of our 790 breaches happened five or more years ago, and 83% of those leaked a password (our catalog, 9 October 2026) | The old entries are the dangerous ones, not the new ones. |
| 41 of the 790 breached sites no longer exist at all, with 374 million records between them (our DNS check, 9 October 2026) | Some accounts can’t be closed. The data is still out. There’s a playbook for those below. |
What is an email breach history?
An email breach history is the record of every data breach that has exposed an email address, listed by the year each breach happened and what leaked alongside it. Because nearly every entry comes from a site you once signed up to, it doubles as an inventory of your old accounts, including the ones you’ve forgotten.
That’s the short definition. Here’s why it beats every other way of finding old accounts.
The usual advice is to search your inbox for “welcome” and “verify your email”, then check the connected-apps page on your Google or Apple account. Do that too. But inbox searches miss anything older than your current mailbox, and connected-apps lists only show logins made through those providers.
A breach history comes from somewhere else entirely: the data that leaked. Your memory never enters into it. If a site you joined in 2013 was breached in 2015, it’s on the list whether or not you’d ever think of it again.
How to find old accounts from your email breach history
- Go to xposedornot.com and type the email address. Use your oldest address first, not your newest.
- Hit Detailed Report on the result. You land on a new page: a “When Were You Breached?” chart up top, the whole list under it.
- Find Breach Summary further down and switch the sort to Oldest breach first. (Newest first is the default, and for this job that’s backwards.)
- Read each entry as three facts: the site, the year, and what leaked (the description names it).
- Sort each one into a pile. Three piles only: you can still log in, the site is gone, or there’s no account behind it at all (that last pile gets its own section below).
- Then do it again for your other addresses. The old work one. The university one you can’t get into any more. All of them.
Call it ten minutes an address. The bit nobody mentions is what a sorted list actually looks like. The old half, it turns out, is where the trouble is.
Part 1, read: why the list is longer than you remember
Researchers in Munich (LMU and the University of the Bundeswehr) put a name on this in a study published at CHI 2026 in April: zombie accounts. Their typical participant knew 341 online services by name, had signed up to 134, and was still sitting on 53 they never touched. Nearly 40% of everything they’d ever created, just lying there.
Before the researchers showed them any lists, almost half the participants said they had no unused accounts at all. After the lists, 110 of 120 found at least one.
So the gap isn’t carelessness. It’s memory. Nobody keeps a ledger of sign-ups, and the sites that ask least of you (a forum, a game, a one-off purchase) are the ones you forget fastest.
Our catalog says the same thing from the other side. Of the 790 breaches we index, 530 happened five or more years ago, and the median breach is 6.9 years old. Most of what a breach history shows you is old by design, because that’s when you signed up for things and stopped.
Time for an actual list. I built this one from real catalog entries, roughly how a 15-year-old address reads once it’s sorted. The names, years and data types are the catalog’s own. The person is a composite.
| Year | Site (real breach) | What leaked with the email | Still exists? | Pile |
|---|---|---|---|---|
| 2012 | password (an easy-to-crack hash) | yes | log in, close or secure | |
| 2013 | iMesh | password (easy to crack) | no, site gone | dead site |
| 2015 | Gaadi | password, username, location | no, site gone | dead site |
| 2012 | Last.fm | password, username | yes | log in |
| 2018 | Dubsmash | password (plain text), username | no, site gone | dead site |
| 2019 | Zynga | password, phone, username | yes | log in |
| 2019 | Collection #1 | password pairs, no site | n/a | no account behind it |
| 2020 | Wattpad | password, date of birth | yes | log in |
| 2024 | Trello | name, username | yes | log in |
| 2026 | Manchester Airports Group | phone, car registration | yes | log in |
Ten entries, three piles. The real list for a 15-year-old address usually runs longer than this (the test address we use internally has 215), and the sort order does the work: the 2012 and 2013 entries are the ones you’d never have remembered on your own.
Part 2, sort: the old half is the dangerous half
Read the table again and notice where the passwords sit. They’re in the old rows.
The whole catalog does the same thing. The share of breaches that leaked a password falls steadily as breaches get newer, and the share that stored those passwords badly falls faster still.
| Breach age (as of 9 Oct 2026) | Breaches | Leaked a password | Stored it in plain text or an easy-to-crack hash |
|---|---|---|---|
| 10 years or more | 230 | 88% | 68% |
| 5 to 10 years | 300 | 78% | 36% |
| 3 to 5 years | 82 | 51% | 21% |
| 1 to 3 years | 90 | 27% | 7% |
| Under 1 year | 88 | 12% | 2% |
Two thirds of the breaches ten years old or more leaked passwords that were either in plain text or trivially crackable. We wrote up how 516 breaches stored passwords earlier this year, and age was the strongest predictor of bad storage.
Newer breaches leak different things. Names in 74% of breaches under five years old (41% in the older ones), phone numbers in 59% (23%), home addresses in 49% (17%).
We covered why a leaked phone number is worse than a leaked email last month. For this post the point is simpler.
Old entries threaten your logins. New entries threaten your inbox and your phone. Sort by that.
Now, does an old password really matter if you’ve forgotten the account? A study published in ACM Transactions on Computer-Human Interaction in November 2024 looked at 1,386 people shown a real breach of one of their accounts.
The breached account was on average 5.98 years old, and 87.2% of participants logged into it yearly or less. Only 27.2% changed the password after being told. Just 6.1% changed it everywhere they’d used it.
And reuse is the whole risk. A USENIX Security 2023 study of one university’s accounts across two decades guessed the current password for 32.0% of accounts whose email had appeared in a breach, using the leaked passwords as the starting point. Passwords found word-for-word in a breach were nearly four times as likely to have been used against the account.
One in three, guessed from passwords that had leaked somewhere else years earlier.
Which old accounts to close first
| What the breach entry says leaked | Do this first | Why |
|---|---|---|
| A password, and you still log in there | Change it today, and anywhere you reused it | 32% of matched accounts were guessable from the leaked password (USENIX 2023) |
| A password, site is dead | Treat the password as burned everywhere; no login to fix | The copy is permanent, the site can’t help you |
| Payment card, ID number, date of birth | Close the account if you can, then watch statements | These don’t reset. See five things worse than a leaked password |
| Phone, home address, name only | Close if unused; expect targeted messages | The risk is in your inbox and phone, not your login |
| Email only, no site named (a combo list is a bundle of old email and password pairs; a stealer log is what malware copied off someone’s PC) | Nothing to close; rotate any password that matches | No account exists; the data is recycled from older breaches |
The last row deserves a word, because it confuses everyone. Seven entries in our catalog aren’t breaches of a site at all: five combo lists, one stealer-log collection and one scrape. Between them they hold 2.97 billion records, a quarter of everything we index.
They show up on your list because your address and a password were in them. There’s no account to close. What they tell you is that a password you used somewhere is in circulation, and the Identity Theft Resource Center’s 2025 report now tracks this as its own category, “previously compromised data”, because it’s what credential stuffing runs on (that’s the trick of trying leaked email and password pairs on other sites until one works).
Part 3, close: what to do with each pile
The site is still there
Log in. If you can’t remember the password, that’s fine, use the reset link; it’s your email. Then go hunting for the delete option. Account, privacy, settings, it moves around.
Expect friction. A January 2024 study in Social Media + Society tried to disable accounts on 25 social networks and found every single one used at least one dark pattern, the paper’s term for things like obstruction, obfuscation and nudges to reconsider.
Deactivate is not delete. A deactivated account still sits on the company’s servers, password and all. So it’s still in the next breach.
Only offered deactivate? Email the company’s privacy address and ask for deletion under GDPR (EU and UK), CCPA (California) or whatever your local law is. A month to answer under GDPR, 45 days under CCPA.
One thing before you hit delete. Strip out whatever you can first: the saved card, your phone number, the address.
And if they flatly refuse? Overwrite the name and birthday with nonsense, set a long random password, walk away.
The site is gone
Nobody writes about this pile. So we measured it. On 9 October 2026 we checked whether the web address recorded for each of the 768 domains in the catalog still resolves (that is, whether the internet still knows where the site lives).
41 whole sites don’t. Nothing at the address. Between them: 374,147,570 records, 32 of the 41 leaked passwords, and 16 stored them in plain text or an easy hash.
| Site (gone), nine of the 41 picked for names you might recognise | Breach year | Records | Password leaked? |
|---|---|---|---|
| Dubsmash | 2018 | 161,835,382 | yes, plain text |
| iMesh | 2013 | 49,594,661 | yes, easy to crack |
| MindJolt | 2019 | 28,364,844 | no |
| Hurb | 2019 | 20,726,194 | yes, easy to crack |
| OMGPOP | 2019 | 7,072,177 | yes, plain text |
| Malindo Air | 2019 | 4,327,245 | no |
| Gaadi | 2015 | 4,260,548 | yes, easy to crack |
| Drizly | 2020 | 2,479,417 | yes |
| Boxee forums | 2014 | 158,690 | yes, easy to crack |
Dubsmash alone is 161 million records with plain-text passwords, from a company that no longer has a website.
You can’t log in. You can’t delete. The password is the only thing you control, so change it anywhere you ever used it, and that’s the whole job.
Was the site bought rather than shut? Search the name plus “acquired”.
If a company still exists, its privacy page takes deletion requests. If nothing comes back after one honest search, stop. The password rotation already did the work that matters.
No account behind it
Combo lists and stealer logs. Nothing to log in to, nothing to delete.
What they tell you is which password is burned. The free password check will confirm it without sending the password anywhere (only part of a hash leaves your browser). If it’s in there, retire it everywhere, and if it was your email password, do that one first and turn on two-step login.
Part 4, lock: the mailbox is the master key
Every reset link for every account on your list lands in one place. If that mailbox is itself an old one, it’s the account to secure before any other.
Two policies worth knowing. Google can delete a personal account that hasn’t been used for two years. Microsoft requires a sign-in at least once every two years to keep an account active.
An old mailbox you use as the recovery address for your current accounts can quietly disappear, and your resets go with it.
So, three small jobs:
- Sign in to every old mailbox once, and set a recovery phone that’s actually yours.
- Check which current accounts list an old address as recovery. Move them to one you check.
- Put two-step login on the mailbox you use most. The US standards body NIST says it plainly in its 2025 guidelines: don’t rotate passwords on a schedule, do change one when there’s evidence it’s compromised. A breach history is that evidence.
Then stop checking, and let the list come to you
Done once, this takes about an hour. Done never, it’s the exposure the Identity Theft Resource Center measured in its 2025 report: 80.1% of people surveyed had received at least one breach notice in the past year, and 40.3% had seen an attempt to take over an existing account.
The way to not repeat the hour is to be told when the list changes. Free breach alerts send one email when your address lands in a newly indexed breach, and once alerts are on, the personal dashboard keeps the full report in one place, no password, just a link by email. If you’d rather your address didn’t appear in public lookups while you clean up, Privacy Shield hides it.
If you look after a company domain, the same list exists for every address on it. Verify the domain and every forgotten account on your staff’s work addresses turns up in one report, free, no size limit. And if you look after other people’s domains, that same report is what xonThreatIntel+ gives you per client.
Want to check my numbers? They all come off the free API, the breaches endpoint, fields breachedDate, addedDate, exposedData, passwordRisk and domain, pulled 9 October 2026.
And if it helped, a star on GitHub is how the next person finds it. Honestly, it makes our day.
FAQ
Why does my email breach history show sites I never signed up to? Three reasons, in order of likelihood: the entry is a combo list or stealer log (no site, just recycled email and password pairs), a company you did business with leaked its customer database through a third party, or someone else used your address to sign up. Read the description on the entry; it says which. If it’s the third case, the account was never yours and there’s nothing to close.
Does deleting an account remove it from my breach history? No. The breach already happened and the copy of the data is permanent, so the entry stays. Deletion does something different: it stops the next breach of that site including you, and it removes your current details from their servers.
How far back does an email breach history go? As far back as the oldest breach your address is in. Ours starts in 2007. 230 of our 790 breaches are a decade old or older. And the typical breach took 1,544 days to reach our index, so your history will keep growing backwards as old files turn up.
Can I check an old email address I can no longer access? Yes. All the check needs is the address itself; you don’t have to get into the mailbox, and we store nothing. Alerts are the one thing you can’t set up (they’re confirmed by email), but you can read the history, retire any password it shares with accounts you still use, and point your recovery links somewhere you can reach.
Appendix: Sources and references
- Our catalog figures: public catalog and the breaches endpoint at api.xposedornot.com/v1/breaches (fields breachedDate, addedDate, exposedRecords, exposedData, passwordRisk, domain), pulled 2026-10-09 (evening re-pull after one addition during the day); 790 breaches, 11,658,404,848 records. Age is counted from the first of the breach month to 2026-10-09; median 6.86 years; 530 breaches at five years or more, 230 at ten or more; password and storage shares per age band as in the table; data classes compared for breaches of five years or more (530) against under five (260)
- Dead sites: DNS resolution attempted on 2026-10-09 for all 768 distinct domains recorded in the catalog (.onion addresses excluded); 43 did not resolve, 5 of which are subdomains of companies that still resolve (not counted); 41 whole sites gone, 46 catalog entries including those subdomains; 374,147,570 records across the 41; 32 with passwords, 16 rated plaintext or easytocrack. Sites that resolve but block automated requests were counted as alive
- No-account entries: breachType ComboList (5), StealerLogs (1), Scrape (1) in the catalog, 2,972,958,863 records together, 25.5% of the total
- Bumiller, Delgado Rodriguez, Mecke, Distler and Alt, “Too Many Zombies: Exploring Challenges and Motivations for (Not) Deleting Unused Online Accounts”, CHI 2026 (April 2026; 341 services known, 134 accounts, about 53 unused, nearly 40%; 110 of 120 participants had at least one)
- Zou, Le, Mayer, Acquisti, Aviv and Schaub, “Encouraging Users to Change Breached Passwords Using the Protection Motivation Theory”, ACM Transactions on Computer-Human Interaction 31(5), November 2024 (n=1,386; account age mean 5.98 years; 87.2% logged in yearly or less; 27.2% changed the password; 6.1% changed it everywhere)
- Nisenoff, Golla, Wei et al., “A Two-Decade Retrospective Analysis of a University’s Vulnerability to Attacks Exploiting Reused Passwords”, USENIX Security 2023 (32.0% of breach-matched accounts guessed; verbatim leaked passwords nearly four times as likely to be exploited)
- Kelly and Rubin, “Identifying Dark Patterns in User Account Disabling Interfaces”, Social Media + Society 10(1), January 2024 (25 social networks, all used at least one dark pattern)
- NIST, SP 800-63B Rev. 4, Digital Identity Guidelines: Authentication and Authenticator Management, final, August 2025 (no periodic rotation; forced change on evidence of compromise; blocklist of compromised passwords)
- Identity Theft Resource Center, 2025 Annual Data Breach Report, January 2026 (3,322 compromises; “previously compromised data” category; consumer survey n=1,040: 80.1% received a breach notice, 40.3% saw an account takeover attempt)
- Verizon, 2026 Data Breach Investigations Report, executive summary, May 2026 (credential abuse 13% of initial access across 22,000+ breaches)
- Google, Inactive Google Account Policy (two years); Microsoft, account activity policy (sign in at least once every two years)
- Related posts: 516 breaches leaked passwords, 56% stored them badly, Phone number leaked? Why it’s worse than a leaked email, 5 things in a data breach worse than a leaked password, Change your email after a breach? Only in these 3 cases, Monitor every domain you own for breaches, Breach disclosure lag analysis
Get alerted when your email shows up in a new breach. Set up free breach alerts, it takes two minutes.
Check out some of our posts for you.
- How Do Data Breaches Happen? Third Parties and Salesforce Lead in 2026
- Email Breach History: Find and Delete the Accounts You Forgot
- September 2026 Breach Roundup: 13.6 Million Records, and the Passwords Are Back
- MCP Makes Your AI Assistant Breach-Aware and Powerful
- Change Your Email After a Breach? Only in These 3 Cases
- Data Breaches by Year: 2026 Sets a New Record in Our Catalog
