Protect Your Passwords|

The data we collect in the Authlogics Password Breach Database is sourced from the Public Domain and should be assumed to be already in the hands of bad actors; our retention of the data does not change this risk. The data we collect is not provided under ‘consent’ per GDPR. However, we are able to retain the data on a “legitimate interest” basis, which does not require explicit consent. At no point do we collect passwords directly from people, with or without their knowledge.

We only store username and password information. The username is typically an email address, and the password is in cleartext. In addition to the clear text, we also store the password in multiple hash formats for quick analysis purposes. We do not attempt to directly “validate” or “test” the data we gather, as this could easily be considered hacking.

We use various data sources, including mainstream news, online forums, torrents, paste bins and other locations on the dark web. Our corporate policy is that we never pay for data. The data is obtained in a variety of formats which often includes a lot of other data which we simply discard, e.g. phone numbers, credit card information, addresses etc. The retained data is then sanitised and analysed for credibility before being added to the database. Where possible, we also record the source of the data for reference.

In the event of a security breach, it is usually up to the company to prove that modern and reasonable best practice has been followed. Poor password management makes it easier for attackers. Multi-Factor Authentication further reduces the risks associated with a password-only approach to authentication. Download our “Dealing with a Data Breach” guide for your next steps.

If a person or organisation would like to be excluded from results provided by our database, we are able to accommodate this. We will still retain the data for overall analysis purposes, however, the existence of the data will no longer be visible. This, of course, does not change the fact that the information may well still exist in other sources online, which is beyond our control. To request exclusion, please email our support team.