How do I check if my personal data has been leaked in India?
Key takeaways
- A stealer log containing a saved password is a live takeover credential, while an email and phone number appearing together is usually just a contact list.
- Never enter your own credentials into a 'check my data' website, because that is the standard way people lose the very accounts they are trying to protect.
- Indian healthcare data is actively traded: an Ernakulam hospital lost over 800GB of patient data in March 2026, and a Kochi hospital was listed by the same ransomware group that month.
- Indians lost over Rs 22,800 crore to telecom fraud and impersonation scams in 2026, so a leaked identifier is inventory for fraudsters rather than a curiosity.
- The DPDP Act 2023 and the DPDP Rules from May 2027 give you a right to ask platforms to erase your data, and a breach at an organisation must be reported to CERT-In within 6 hours.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
What should I search for, and what does a hit mean?
Search on the identifiers that actually matter for your risk: the email you use for banking, your primary phone number, your PAN, your Aadhaar-linked identifiers, and any username that appears in a breach. Then read the result type carefully, because the type changes your response completely. An email and phone number together in a leak is a contact list and mostly a phishing risk. A saved password with the URL of a site is a takeover credential, because credential stuffing against the same password is the next move. A session cookie or token is worse, because it may work without the password. And a bank, UPI or card record is a direct financial route that needs a bank call the same day. A monitoring service searches all of these continuously, which is why the identifier you nominate matters more than how deep any single search goes.
How do I check without creating a second problem?
Four rules. Use a service that searches from its own infrastructure and never asks you to type a password into the check page, because sites offering free leak checks harvest exactly the credentials people want to verify. Nominate your own identifiers rather than uploading a file of personal data to be 'scanned'. Run the check from a device you trust, and treat any email or WhatsApp message asking for more identifiers as a red flag, because that message is probably the fraud you came here to prevent. And do not engage with what you find: do not reply to a forum seller, do not download a leaked archive, do not attempt a purchase to test it. Hand the evidence to your incident responder, a CERT-In empanelled digital forensics firm, or the police, and let them handle the material.
What should I do immediately after a confirmed leak?
Act in a ranked order, because the types of hit demand different responses. If a stealer log contains a password, change that password everywhere it is reused, starting with your email account, and change it from a clean device. Revoke all active sessions on every affected service, because cookies survive a password change. If a bank, UPI or card credential appears, call the bank's fraud helpline the same day, request a transaction limit and a new card, and ask for channel-based confirmation. If a PAN or Aadhaar-linked identifier appears, file on cybercrime.gov.in and helpline 1930, and update your PAN profile through your bank. And if the exposure is at an organisation rather than with you personally, remember that the organisation's CERT-In six-hour clock started the moment it noticed.
What does the DPDP Act 2023 mean for a person whose data leaked?
It gives you a set of rights against the entities that hold your data, and it creates a route to complain about a breach. A data fiduciary must notify the affected data principal and the Data Protection Board when a personal data breach is likely to cause harm, and the DPDP Rules notification duties for data principals start from May 2027. You also gain the right to request erasure of data that has served its purpose, to access what is held about you, and to nominate someone to exercise those rights if you die. Practically, for a leak, the most valuable use of the Act is the erasure and access request to the platform or company holding the exposed copy, filed in writing, because it creates a dated record that a company cannot later deny.
| What was found | What it indicates | Required action |
|---|---|---|
| Email and phone number together | Contact list sold for phishing and SIM-swap lures | Passkeys, and watch for targeted call and SMS lures |
| Saved password in a stealer log | Live credential from an infected device | Change password everywhere it is reused, from a clean device |
| Session cookie or token | Account may still be accessible without a password | Revoke all sessions now, then change the password |
| Bank, UPI or card details | A direct financial fraud route | Bank fraud helpline the same day, new card, transaction limit |
| PAN or Aadhaar-linked identifier | Identity fraud exposure | Report on cybercrime.gov.in and helpline 1930, update PAN profile via bank |
| Employer or health record data | Targeted fraud or extortion potential | Alert the institution, monitor credit, file a police complaint |
What are the frequently asked questions?
Get a straight answer on this
Send us the identifiers you want checked and we will return a fixed-price exposure report with a ranked remediation list and a re-scan.
Send us the details See pricing