How do I know if I’m in the clear?

A reader is checking the helpful haveibeenpwned site to find out if any of his accounts have been compromised, but he still has questions.

“When I first ran haveibeenpwned, I learned I was, so I went on a massive time-consuming effort to change all passwords and security questions. This was toward the end of last year through the beginning of this year. I still find my data was compromised, from both sites. I’m not clear about how to confirm I am now clear. I can’t change that they got data before, but I can’t tell if they got data after I did all that work….

Haveibeenpwned told me the two sources that got me were Adobe and LinkedIn. Adobe I can understand; but LinkedIn? I did everything I could do (that I knew about) to close my account with them, many many years ago. I’ve been retired for 29 years and have no urge to find new employment. I still get the occasional (1-2 a year) email that tells me someone wants to be linked with me.”

The site lets you know if your email address has been compromised. They draw that information from publicly leaked lists of breaches on various sites and put that information all together in one place where you can search to see if your information has been compromised. What this site tells you is if your email address was found in those lists. You can click here to check it out.

If you’re in the clear, you see this result.

If it’s been compromised, you see this.

The idea is that you now know to go change your email address and pay close attention to any signs that your identity has been stolen or your bank account compromised. The site doesn’t have any actual access to your accounts. They can’t know that you’ve changed your password and secured your account or that you’ve deactivated an account that you no longer use. The only info they have is if your email address was contained in those leaked lists.  Those two accounts will always be listed because they were compromised at one point.

Even if you completely deactivate an account, the address will still be there because it was on the list of breached email addresses.

If your data has been compromised, you can scroll down to see which breach or breaches included your data. Just check the dates to see if it’s recent.