I use Firefox Monitor to keep me updated if my email ever turn up on breaches or data dumps. It curates breaches data from many sources and cross reference our email to check if our email turn up on some breach somewhere. For sometimes I feel comfortable with it. If my email do turn up on one, I simply follow the common sense procedure to secure my account or abandon that site altogether if its not very important.

The common sense procedure I took commonly involves changing password, enabling 2FA if the site offers it (usually they do, especially after bad publicity from a breach). If I do not have password with the site (i.e. if I signed up using social media account) I simply disconnect whatever token or authorization I already gave to the site. If I keep phone number or other sensitive data on the site (e.g credit card) I simply removes it. The site can't keep my data safe once. I lost trust in it. Simple as that.

Lately however, I keep seeing my email turn up on site breaches I do not remember sign up to, or even ever visited.

And there are lots of them! Almost every month my email turn up on some breach somewhere and it's always a new site I'm not familiar with

How I'am sure I have never visited some of these sites? First the site's URL don't turn up on my browser history and I sync my browser history and seldom cleared it. Second, some of these sites are outright not making any sense for me to visit. Dominos Pizza India? Republican Party of Texas? JD China? I'm not even been in these countries and the default language of these sites are in language I don't speak.

I know there are ways for me to inadvertently visit these sites (ads network comes to mind, iframe is another). Other party can also use my email address to register to these sites but that should be easily detectable you just check if you are getting confirmation email.

What actually happened here? How do I curb this and prevent this to ever happen again?

  • For sites that do not require confirmation of email, anyone can use any email address to sign up for things. My email address gets sued for a wide range of random sites and services. Check your email filters to see if there are "thanks for signing up for our site" emails.
    – schroeder
    Dec 7, 2021 at 9:38
  • Err. Dominos Pizza India doesn't allow e-mail registration, you need to provide either your Indian phone number or login via Google/Facebook.
    – ximaera
    Dec 7, 2021 at 9:52
  • 1
    See this article by Troy Hunt: Why am I in a data breach for a site I never signed up to? Dec 7, 2021 at 14:56
  • @FireQuacker Thanks, the article is very relatable. Just as I thought some of these breaches are just bad webmasters not verifying email ownership, deliberately or not.
    – bluearth
    Dec 8, 2021 at 2:09
  • @schroeder I did that. Searched my inbox/spam for traces of registration to these sites. Didn't find any. .
    – bluearth
    Dec 8, 2021 at 2:15


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.