Some breaches are hidden from anonymous searches because merely appearing in them — regardless of any activity — could be used to blackmail, harass, or shame the person, so Have I Been Pwned flags them "sensitive" and only reveals them to the account owner after email verification. The classification covers adult, dating, health, addiction, political, and certain financial or legal services, and it was introduced in 2015 after the Ashley Madison dump was weaponized against the people in it. The underlying stolen data is still public wherever attackers posted it; the flag only stops a stranger from confirming your association through HIBP's search box.
That's the summary an AI Overview will give you. What it can't show you is how the hidden-count actually works when you run a search, which categories trip the flag, and what the trade-offs are between hiding a breach and warning its victims. Below is a diagram of the verification flow, a table of what's classified as sensitive and why, a side-by-side of the privacy-versus-transparency arguments, and a step-by-step of what to do when your own address is caught in one.
The Ashley Madison Turning Point
The concept of hiding sensitive breaches wasn't part of Have I Been Pwned's original design. The feature was added specifically in response to one of the most controversial data breaches in history: Ashley Madison.
The 2015 Ashley Madison Breach
In July 2015, hackers breached Ashley Madison, a dating website marketed to people seeking extramarital affairs. The attackers dumped the personal information of more than 30 million users publicly, including:
- Email addresses and usernames
- Real names and addresses
- Payment information and transaction details
- Sexual preferences and private messages
- GPS coordinates and timestamps of mobile app usage
What made this breach uniquely devastating wasn't just the scale—it was the highly personal and potentially damaging nature of simply being associated with the site. Unlike breaches of e-commerce or social media platforms, where membership itself is unremarkable, appearing in the Ashley Madison breach could destroy marriages, careers, and reputations regardless of whether someone actually used the service.
The Weaponization Problem
Shortly after the Ashley Madison data became public, a disturbing trend emerged: people began using breach checking tools to investigate whether their partners, colleagues, or targets appeared in the breach. This turned breach checkers from protective security tools into weapons for:
- Relationship destruction - Spouses checking if partners had Ashley Madison accounts
- Blackmail and extortion - Criminals threatening to expose individuals' presence in the breach
- Harassment campaigns - Malicious actors targeting people found in the breach
- Professional damage - Employers or competitors using breach data to harm individuals' careers
- Public shaming - Online vigilantes exposing people who appeared in the breach
Troy Hunt, creator of Have I Been Pwned, recognized that allowing anyone to publicly search for anyone else's email in such breaches transformed a security tool into a privacy invasion mechanism.
How Sensitive Breach Protection Works
In response to the Ashley Madison incident and similar concerns, HIBP implemented a verification system for sensitive breaches that balances transparency with privacy protection.
The Verification Process
When you search an email address that appears in sensitive breaches, here's what happens:
1. Initial Search Results: Your search returns all non-sensitive breaches immediately. The total breach count includes sensitive breaches, but specific details aren't shown. You'll see a message like "This address appeared in X breaches, including Y sensitive breaches that require verification to view."
2. Verification Request: To see sensitive breach details, you must verify ownership of the email address. You initiate this by clicking "Verify this email address" on the results page.
3. Verification Email: HIBP sends an email to the address containing a unique verification link. This email explains that sensitive breaches require confirmation and provides the verification URL.
4. Confirmation: Clicking the verification link confirms you own the email address and returns you to HIBP with full access to sensitive breach details for that specific address.
5. Time-Limited Access: The verification is typically session-based. You can view sensitive breaches for your verified email during that session, but future searches may require re-verification for security.
Alternative Verification Methods
Beyond individual email verification, HIBP provides additional access paths for sensitive breach data:
Domain Owner Verification: Organizations can prove they control an entire domain (company.com) and then search all email addresses at that domain, including sensitive breaches. This allows security teams to monitor employee exposure without requiring individual verification from every employee.
Notification Subscriptions: Users who subscribe to breach notifications for their email address receive alerts about all future breaches, including sensitive ones, without additional verification. The initial subscription setup requires email verification.
API Access with Authentication: HIBP's paid API includes access to sensitive breach data for verified domains and authenticated searches, enabling security tools and password managers to check sensitive breaches programmatically.
What Makes a Breach "Sensitive"?
Not all data breaches receive the sensitive classification. HIBP applies this designation based on whether someone's presence in the breach could adversely impact them if others discovered their association with the service.
At a glance: what trips the sensitive flag
| Category | Example services | Why it's flagged | Would a stranger seeing it cause real harm? |
|---|---|---|---|
| Adult & dating | Ashley Madison, Adult FriendFinder, cam/subscription sites | Association implies private sexual behavior | Yes — blackmail, divorce, reputation |
| Health & mental health | Therapy platforms, addiction recovery, fertility, telehealth | Reveals a medical or psychological condition | Yes — discrimination, insurance, stigma |
| Political & ideological | Activist orgs, religious forums, controversial movements | Association can invite persecution | Yes — context-dependent, sometimes physical safety |
| Financial hardship | Debt consolidation, bankruptcy, payday loans | Signals financial distress | Yes — employment and social stigma |
| Sensitive legal | Criminal-defense matching, DUI/family-law services | Reveals a legal problem someone kept private | Yes — professional and personal damage |
| Mainstream (not flagged) | LinkedIn, Adobe, Dropbox, most retail | Having an account is unremarkable | No — shown to anyone immediately |
The test HIBP applies is not "is this data valuable?" but "would the mere fact of appearing here hurt this person if a stranger found it?" That is why a giant retail breach is public while a small dating-site breach is hidden.
Categories of Sensitive Breaches
1. Adult and Dating Services: Sites related to adult content, extramarital affairs, or alternative relationship styles fall into this category. Beyond Ashley Madison, this includes:
- Adult content subscription services
- Alternative lifestyle dating platforms
- Adult entertainment sites
- Services marketed for casual encounters
Simply having an account on these platforms—regardless of active use—can damage reputations, relationships, and careers if publicly discoverable.
2. Health and Medical Services: Breaches of health-related services can reveal sensitive medical information:
- Mental health platforms and therapy services
- Fertility and reproductive health sites
- Addiction recovery communities
- Chronic condition support forums
- Telehealth platforms dealing with sensitive conditions
Medical privacy is protected by law in many jurisdictions (HIPAA in the US, GDPR health data protections in EU), and health-related breaches deserve extra privacy protection.
3. Political and Ideological Platforms: Services associated with political movements, ideologies, or causes can be sensitive depending on context:
- Political organizing platforms
- Activist communities
- Religious or spiritual forums
- Platforms associated with controversial movements
In some countries or contexts, association with certain political or ideological groups can lead to persecution, discrimination, or professional consequences.
4. Financial Services: Certain financial services, particularly those related to debt, bankruptcy, or financial hardship, may be classified as sensitive:
- Debt consolidation services
- Bankruptcy assistance platforms
- Payday loan services
- Financial counseling for serious difficulties
Financial struggles carry stigma, and exposing individuals' use of these services can harm their personal and professional lives.
5. Legal Services: Platforms related to legal issues, particularly criminal defense or sensitive family law matters, may qualify:
- Criminal defense attorney matching services
- Platforms for specific legal issues (DUI, domestic issues, etc.)
- Legal aid services for specific sensitive situations
Legal matters are often private, and exposing someone's search for specific legal help can be damaging.
The Privacy vs. Transparency Debate
The decision to hide sensitive breaches isn't universally accepted. It raises important questions about the balance between individual privacy and public security awareness. Here are the two sides side by side:
| Concern | Case for hiding | Case against hiding |
|---|---|---|
| Harassment & blackmail | Verification blocks strangers from confirming an association | The raw dump is public anyway, so motivated attackers still find it |
| Victim awareness | Owners can still verify and learn their exposure | Friction means some victims never verify and stay unaware |
| Consistency | Protects the clearest high-harm categories | "Sensitive" is subjective — one dating site is flagged, another isn't |
| Real protection | Deters casual snooping, which is most snooping | Data isn't actually removed, only harder to search on HIBP |
| Encourages checking | People check more freely when results stay private | Users may over-trust the "hidden" label as if it means "safe" |
| Which wins? | The pragmatic view: verification stops the common, low-effort abuse without pretending the data is gone. | Purists prefer full transparency, but that reintroduces the exact weaponization the feature was built to prevent. |
Arguments for Hiding Sensitive Breaches
1. Prevents Harassment and Blackmail: Public searchability of sensitive breaches enables malicious actors to target, extort, or harass individuals. Requiring verification significantly reduces this risk by ensuring only the account owner can confirm their presence in the breach.
2. Reduces Secondary Victimization: People who appear in breaches are already victims of a security failure. Making sensitive breaches publicly searchable victimizes them again by enabling anyone to discover their association with sensitive services.
3. Encourages Breach Checking: If users fear that checking their email might reveal sensitive information to anyone watching their network traffic or looking over their shoulder, they're less likely to use breach checkers. Privacy protection makes security checking safer.
4. Respects Context and Consent: People who willingly share their email with a private service haven't consented to that association becoming publicly searchable. Hiding sensitive breaches respects the original privacy expectations.
5. Prevents Database Scraping: Public searchability enables attackers to build databases of who has accounts on sensitive platforms by systematically searching email addresses. Verification requirements prevent bulk collection.
Arguments Against Hiding Sensitive Breaches
1. Reduced Security Awareness: Hiding breaches means users might not realize their sensitive accounts were compromised unless they verify, potentially leaving them vulnerable to account takeover or blackmail.
2. Inconsistent Protection: The sensitive designation is subjective. Why is one dating site sensitive but another mainstream dating app not? The inconsistency can seem arbitrary.
3. Discovery Obstacles: Verification adds friction. Users might not bother verifying, miss critical security information, and fail to change compromised passwords on sensitive accounts.
4. False Sense of Security: Users might believe their information is "protected" when it's actually just hidden from HIBP—the breach data itself remains publicly available to anyone who downloads it from where hackers posted it.
5. Transparency Principle: Some argue that if breach data is already public (which it must be for HIBP to include it), hiding it on HIBP doesn't actually protect privacy—it just moves where people can access it.
The Reality: Balanced Pragmatism
The sensitive breach feature represents a pragmatic middle ground. It acknowledges that:
- Breach data is already public - Anyone can download breach dumps from where hackers posted them
- HIBP isn't making data public - It's aggregating already-leaked information
- Public searchability amplifies harm - Easy searchability increases the number of people who will look up others
- Verification creates meaningful friction - Most casual snooping is deterred by verification requirements
- Account owners need to know - The verification process ensures affected individuals can still learn about their exposure
How Common Are Sensitive Breaches?
While exact numbers fluctuate as new breaches are added, sensitive breaches represent a small but significant portion of total breaches in HIBP's database.
Current Statistics
As of 2025, HIBP tracks nearly 900 compromised websites and services across its entire database. Of these:
- Approximately 40-50 breaches are classified as sensitive (roughly 5-6% of total)
- Over 500 million accounts appear in sensitive breaches
- Many users appear in multiple breaches, with some in both sensitive and non-sensitive compromises
The relatively small number of sensitive breaches means most HIBP searches return full results immediately without verification. However, given the scale of some sensitive breaches (Ashley Madison alone had 30+ million accounts), a significant number of individuals are affected by the sensitive classification.
Common Sensitive Breaches in HIBP
While the full list evolves as breaches are added and occasionally removed (if they're determined to be invalid or duplicate data), some of the most significant sensitive breaches include:
- Ashley Madison (2015) - 30+ million accounts from the extramarital dating site
- Adult FriendFinder Network (2016) - 412 million accounts across multiple adult-oriented dating and entertainment sites
- Various adult content sites - Multiple breaches of subscription-based adult content platforms
- Mental health and therapy platforms - Services where the mere fact of having an account suggests seeking mental health support
- Specific political or ideological platforms - Context-dependent based on geopolitical considerations
Impact on Security Practices
The sensitive breach feature affects how individuals and organizations should approach breach checking and security hygiene.
Start by checking which breaches — sensitive or not — already include your address:
For Individuals
1. Don't Ignore Verification Requests: If HIBP indicates sensitive breaches require verification, take the time to verify. You need this information to protect yourself, even if the breach is embarrassing.
2. Use Notification Services: Subscribe to breach notifications for your email addresses. This enables automatic alerts for future breaches (including sensitive ones) without repeated verification.
3. Check All Email Addresses: Don't forget to check email addresses you might have used for sensitive accounts—secondary emails, old accounts, or addresses you don't use anymore.
4. Act on Results Regardless of Sensitivity: Whether a breach is marked sensitive or not, take the same actions: change passwords, enable two-factor authentication, monitor for suspicious activity.
5. Consider the Broader Threat: Remember that sensitive breach classification protects you from casual snooping on HIBP, but the actual breach data is publicly available. Treat sensitive breach exposure as seriously as any other compromise.
For Organizations
1. Implement Domain Verification: Security teams should verify organizational domains in HIBP to monitor employee exposure across all breaches, including sensitive ones.
2. Handle Sensitive Breaches with Discretion: When employee emails appear in sensitive breaches, approach the situation with sensitivity and professionalism. Focus on security (password changes, 2FA) without judgment about which services were breached.
3. Use API Access Appropriately: Organizations using HIBP's API to check breaches should implement proper access controls and privacy protections for sensitive breach data.
4. Include in Security Awareness: Educate employees that all accounts—including personal and sensitive ones—should use unique passwords and 2FA, because breaches happen to all types of services.
The Future of Sensitive Breach Protection
As breach checking evolves, so do approaches to handling sensitive data.
Emerging Approaches
1. Differential Privacy Techniques: Future breach checkers might implement mathematical privacy protections that allow individuals to learn about their own exposure while preventing mass collection of who appears in breaches.
2. Zero-Knowledge Proofs: Cryptographic techniques could enable checking if you're in a breach without revealing which breach or even confirming you performed the check.
3. Enhanced Verification: More sophisticated verification methods (device-based authentication, cryptographic signatures) could provide stronger proof of email ownership while maintaining ease of use.
4. Context-Aware Sensitivity: Artificial intelligence might help determine breach sensitivity based on cultural, geographic, and temporal context, recognizing that sensitivity varies across regions and changes over time.
5. Decentralized Breach Checking: Blockchain or distributed systems could enable breach checking without centralized databases vulnerable to bulk scraping or subpoena.
Alternatives for Privacy-Conscious Users
If you're concerned about even the metadata of checking breaches (what if someone learns you searched your email?), alternatives exist:
1. Firefox Monitor: Mozilla's breach checking service (powered by HIBP data) integrates with Firefox browsers and can check automatically without manual searches.
2. Password Manager Integration: Services like 1Password, Dashlane, and Bitwarden integrate HIBP checks and alert you to compromised credentials without manual searches.
3. Domain-Based Monitoring: Organizations can monitor entire domains without revealing which specific employees checked which accounts.
4. Local Database Downloads: For truly privacy-conscious checking, some services allow downloading anonymized breach databases for local checking (though this doesn't include raw passwords or sensitive details).
Conclusion
The sensitive breach feature represents a thoughtful approach to a complex problem: how to provide security-critical information while protecting individuals from weaponized use of breach data. By requiring email verification to view details of breaches that could be particularly damaging if publicly searchable, services like Have I Been Pwned balance transparency with privacy protection.
For users, the key takeaway is simple: always verify when prompted. The temporary inconvenience of email verification is far outweighed by the security value of knowing whether your sensitive accounts were compromised. Treat sensitive breaches with the same seriousness as any other data exposure—change passwords, enable two-factor authentication, and monitor for suspicious activity.
The sensitive breach feature reminds us that cybersecurity isn't just about technical protections—it's also about respecting human dignity and preventing security tools from becoming vehicles for harm. In a world where data breaches are increasingly common and increasingly damaging, finding ways to share critical security information while protecting privacy isn't just good practice—it's an ethical imperative.
Ready to check if your accounts have been compromised? Learn more about how often breach databases are updated to understand when new incidents become searchable and how to set up automatic notifications.