When you search for your email address on a breach monitoring service, you're likely confronted with a sobering number: the breaches where your data appears. But there's a critical question most people don't think to ask: are those breaches actually verified?
In the LeakedSource database, which indexes over 30.7 billion compromised records, 30,742 breaches carry verified status—while 5,541 remain unverified. That gap represents more than just a technicality. It's the difference between confirmed exposure and potential false alarms.
What Makes a Breach "Verified"?
A verified breach meets specific criteria that confirm its authenticity. Security researchers don't simply take every dump posted on a hacking forum at face value. Instead, verification typically requires:
- Sample validation — checking if leaked credentials actually work or match known patterns
- Source confirmation — identifying where the data originated and how it was obtained
- Data uniqueness — determining if the breach contains original information rather than recycled records from previous leaks
- Technical markers — analyzing database structures, timestamps, and metadata for consistency
Consider the XSS.IS Combolist, our largest indexed breach with 2.4 billion records leaked in February 2019. This massive aggregation of email addresses, usernames, and plaintext passwords earned verified status because researchers could cross-reference its contents against known breaches and confirm the credential patterns matched legitimate compromises.
Unverified breaches, by contrast, often come from dubious sources. They might be:
- Fabricated data generated to boost a hacker's reputation
- Duplicates of existing breaches repackaged under new names
- Partial leaks where the source and scope remain unclear
- Honeypot data designed to trap credential stuffing attempts
The Combolist Problem: Recycled Credentials Cloud the Picture
Among the 36,283 breaches in our database, 12,513 are classified as combolists—collections of credentials aggregated from multiple sources. Another 1,717 are hybrid database-combolist dumps. Together, these represent over 38% of all indexed incidents.
Combolists present unique verification challenges. The Misc Combolists entry, containing 1.9 billion records from December 2015, is essentially a mega-aggregation. Your email appearing in this breach doesn't mean you were compromised in December 2015—it means your credentials from some earlier breach were recycled into this collection.
This is why breach type matters when assessing your exposure. A database breach like Verifications.io (722 million records, verified) represents a single point of compromise with a clear timeline. A combolist like Ga$$Pacc Collection (518 million records) represents credentials harvested across years from countless sources.
Stealer Logs: The New Frontier of Verification Complexity
The breach landscape has evolved dramatically. Of all indexed breaches, 17,445—nearly 48%—are stealer logs. These automated malware harvests capture credentials, cookies, and autofill data directly from infected devices.
Stealer logs complicate verification because they're inherently fragmented. Each log represents one compromised machine. Unlike a database breach affecting millions at once, stealer logs accumulate gradually, with 10,000 to 100,000 victims per campaign.
The most recent breaches in our database—Abaco Informatica (393,394 records, October 2026), Flink (752,799 records, September 2026), and others—likely represent these ongoing stealer operations rather than traditional server breaches. Verifying them requires confirming the malware variant, infection timeline, and data freshness.
Why Verification Status Should Change Your Response
When you discover your data in an unverified breach, you shouldn't ignore it—but you should calibrate your response:
For verified breaches:
- Change passwords immediately on the affected service and any accounts sharing those credentials
- Enable multi-factor authentication where available
- Monitor financial accounts if payment data was exposed
- Consider the exposed data types (plaintext passwords are worse than hashed passwords)
For unverified breaches:
- Investigate whether you actually used the supposedly compromised service
- Check if the breach date aligns with when you created your account
- Look for corroborating reports from security researchers
- Focus on general password hygiene rather than panic-driven changes
With 31,978 breaches exposing plaintext passwords and 29,865 exposing email addresses in our database, credential reuse remains your biggest vulnerability. A single verified breach where you used a recycled password can cascade into account takeovers across services you've never heard of being compromised.
The Numbers That Matter Most
Here's what our database statistics reveal about real-world exposure:
1,822 breaches contain plaintext passwords. These are the highest-priority threats because attackers can immediately use these credentials without cracking hashes.
2,621 breaches contain password hashes requiring computational effort to crack. Your exposure here depends on hash strength—bcrypt and Argon2 hashes resist cracking; MD5 and SHA-1 hashes don't.
1,104 breaches expose phone numbers, enabling SIM-swapping attacks and social engineering beyond simple credential stuffing.
The MySpace breach from June 2008, containing nearly 302 million records, remains relevant today—not because anyone uses MySpace, but because those passwords appear in modern combolists. If you recycled that 2008 password anywhere else, you're exposed now.
Take Control of Your Exposure
Verification status isn't about creating a false sense of security around unverified breaches. It's about understanding evidence quality so you can prioritize your response effectively.
With over 30 billion records indexed across 36,283 incidents, the question isn't whether your data has been compromised—it's where, when, and how severely. Check your exposure status at LeakedSource to see exactly which verified breaches contain your information, what data types were exposed, and when you need to take action.
Because knowing the difference between a verified credential dump and recycled combolist noise isn't just technical trivia—it's the foundation of intelligent digital self-defense.