Has your company been breached? Free data breach check
Please enter the domain without www.
For legal reasons, this security check may only be performed for domains you own or have explicit permission to check.
What does the free data breach check cover?
BreachFinder checks for free whether publicly known data breaches exist for your company domain and which email addresses of your domain are publicly known. It also rates the domain's reputation. You see the result after verifying your business email address.
- Known data breaches for the domain: indications of incidents in which data of your domain has surfaced.
- Publicly known email addresses: addresses of your domain found in the evaluated sources.
- Domain reputation: an assessment of the domain based on publicly available indicators.
How the check works in three steps
- Enter your domain: your company domain without “www.”, for example company.com.
- Verify your email: you receive a verification link at your business address. It is valid for 24 hours and can be used once.
- View the result: after verification you see the evaluation for your domain.
What the check does not do
The check is a snapshot based on publicly available information and data captured in Darkscope sources. It is not a penetration test, does not test any of your systems and does not guarantee complete coverage of all data breaches or dark web content.
Frequently asked questions about the data breach check
What is a data breach?
A data breach happens when data such as email addresses, passwords or internal information is exposed unintentionally or without authorization – for example through an attack on a service provider or malware on a device. Affected data then often shows up in publicly accessible collections or dark web sources.
Is the check really free?
Yes. The security check for your domain is free and non-binding. Only the optional, more detailed cyber intelligence reports are paid.
Why do I need a business email address?
For legal reasons the check may only be run for your own domains or with the domain owner's permission. Free providers such as Gmail are therefore not accepted. We send the verification link to your company address, and you use it to open the result.
What does it mean if no result is shown?
The check shows known indicators found in the sources it evaluates. No result is not proof that no incident occurred: not every breach becomes public, and not every source is covered.
What should I do if my company's data was found?
Change affected passwords, enable multi-factor authentication and review the affected accounts for suspicious activity. If personal data is involved, check whether you must notify your data protection authority – under GDPR Art. 33 this is generally due within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to individuals.
Does the check replace dark web monitoring or a penetration test?
No. The check is a snapshot for one domain. It neither tests your systems nor monitors continuously. APAsec offers continuous monitoring with Apascope; the more detailed reports are available on the reports page.
Who is behind BreachFinder?
BreachFinder is an offering of APASEC ApS (Vestergade 28, 6440 Augustenborg, Denmark). The evaluation uses data sources from Darkscope.
Guides on data breaches and cyber security
- How to Check Whether Your Company Has Been Affected by a Data Breach
- What to Do After a Data Breach: Immediate Steps and GDPR Notification
- Infostealer Logs Explained: How Stolen Credentials Arise and What You Can Do
- Company Credentials Found on the Dark Web? Causes, Risks and Immediate Steps
- Dark Web Monitoring for Business: What It Does and Where the Limits Are
- Cyber Intelligence Reports (CIQ360): What a Threat Landscape Report Contains
- Reporting a data breach under GDPR Art. 33: step by step
- Data breach check tools compared: Have I Been Pwned and alternatives for businesses
- Penetration test or data breach check: what is the difference?
- Free security check for small businesses: what you can test yourself