In every plan
Look inside any leak
Record count, file types and corporate vs personal emails at a glance — before you open a single file.
Which plans include it
Have I Been Ransomed?
Check in seconds if your email, phone, password, crypto wallet or Telegram data was exposed in ransomware leaks, stealer logs or traditional breaches.
Search in
(0/0 fields)
Bot protection by Cloudflare
Checking your browser…
- Free
- Anonymous: searches aren’t stored
- No signup
89,720,494,690 records 21,940 leak sources indexed Peer-reviewed method (MDPI)
Searching every source…
Type what you want to check and press Scan: we detect the field for you.
What we search
Four places your data ends up
Most breach checkers stop at hacked databases. We also index ransomware leak sites and stealer logs, and decrypt the wallets and Telegram folders inside them to connect them across every leak.
-
Ransomware leak sites
When a company refuses to pay, the gang publishes what it stole: contracts, payrolls, mailboxes and customer databases.
-
Stealer logs
Malware like RedLine, Lumma, Vidar and RisePro copies saved passwords, cookies and crypto wallets from infected computers.
-
Traditional breaches
Databases stolen from websites and apps, then sold or shared on hacking forums and markets.
-
Telegram dumps
Leaked data traded in Telegram channels and groups, indexed and connected with every other source.
How it works
Know where you’re exposed in three steps
-
Search
Type an email, phone, username, wallet or domain. We detect the field for you, and nothing you type is stored.
-
See where it leaked
Each match shows the type of leak, the source and the date, so you know which accounts to secure first.
-
Get alerted
Create a free account to monitor your emails and phones: a first report with every leak, then an email only when something new appears.
For investigators and security teams
Need more than a yes or no?
Plans open every record and add the tools professionals use every day. Short clips, recorded on haveibeenransom.com with demo data.
In every plan
Export results in one click
Download your results as CSV or JSON and drop them straight into your own tools.
Which plans include it
Agency & Gov only
A client-ready report in minutes
Enter a domain, pick the language and get a password-protected PDF intelligence report.
Which plans include itRecommended plan
Professional: everything for day-to-day investigations
- 2,000 searches a day, web and API
- Search inside ransomware leaks
- Newest leaks first
- Clear Data add-on when you need it
Proof
Built on research you can check
Peer-reviewed · MDPI Electronics · 2025
RDBAlert: An AI-Driven Automated Tool for Effective Identification of Victims’ Personal Information in Ransomware Data Breaches
Read the paper
- Total records
- 89,720,494,690
- Leak sources indexed
- 21,940
- Fields you can search
- 17
- Daily alerts
- 24h
FAQ
Frequently asked questions
Is this leak search free?
Yes. Looking up whether your email, phone, wallet or Telegram data appears in ransomware leaks, stealers or breaches is completely free, anonymous and does not require signup.
What data sources do you search?
Ransomware leak sites, stealer credential logs (RedLine, Lumma, Vidar, RisePro and more), Telegram dumps and traditional breaches. Our indexing methodology is peer-reviewed (MDPI Electronics). You can browse every leak we index.
What is a stealer?
A stealer is malware designed to harvest credentials, cookies, crypto wallets and personal data from infected machines. The stolen logs are then sold or leaked on dark web markets.
How is this different from “Have I Been Pwned”?
HIBP focuses on traditional breaches. We additionally cover ransomware victim leaks, stealer logs, cracked wallets and Telegram data — sources rarely indexed elsewhere.
Do you store what I search?
No. Search terms are not logged or persisted. Only aggregate counters (without the query) are kept for capacity planning.
Can I get alerted automatically?
Yes. Create a free account and add the emails or phones you want to monitor. You’ll receive an initial report with every existing leak, and after that an email only when something new appears.
What do the paid plans add?
The free search shows where your data appears. Plans are for people who investigate leaks: the API (from 100 to 20,000 requests a day), search inside ransomware leaks, newest-first sorting, exports and Leak Intel — plus domain overview and AI reports on Cybersecurity Agency. Compare plans.
Know the moment your data leaks.
Monitor your emails and phones for free. We send you a first report with every known leak, then an email only when something new appears.