In a recent personal audit published by MakeUseOf, security writer Gavin Phillips ran his old email addresses through Troy Hunt’s breach-notification service, Have I Been Pwned (HIBP), after more than 25 years online. Expecting a handful of hits, Phillips instead uncovered his details across more than 50 breach records spanning his remembered accounts—including a 20-year-old Hotmail address caught in the 2017 Onliner Spambot dump and a longer-tenured address tied to 22 separate breaches, stretching from the 2012 LinkedIn compromise to a Chess.com listing in August 2026.
While those specific counts reflect one writer's history rather than a universal benchmark, the underlying pattern is a textbook lesson in personal cybersecurity and digital hygiene. Dormant accounts are more than digital clutter; when paired with reused passwords or active recovery links, they become convenient reconnaissance tools for phishers and automated login attacks.
How Have I Been Pwned Actually Works (and What It Leaves Out)
Launched by security researcher Troy Hunt in December 2013 in the wake of Adobe's October 2013 data breach, Have I Been Pwned has grown into the gold standard for public breach lookups. Inspecting HIBP’s current public index shows the service now tracks 1,046 pwned websites and more than 17.8 billion pwned addresses, alongside paste records and stealer-malware logs.
However, understanding what an HIBP lookup actually proves requires separating two distinct features documented in the service's official FAQ:
- Email Address Searches: When you type an email address into HIBP, the system checks which loaded breach datasets contain that identifier. Crucially, HIBP does not store or return user passwords alongside email addresses. Nor does it log the email addresses people search for on demand, unless you actively subscribe to receive future breach notifications—in which case it stores only the email address, subscription date, and a verification token.
- Pwned Passwords: HIBP runs a separate password-checking service that stores SHA-1 hashes of exposed passwords completely detached from any email address or personal identity. If a password shows up here, it means that exact secret has appeared in a past breach and should never be used again.
There are also strict boundaries on what a free on-demand search will show you. According to HIBP’s documentation, the platform classifies certain incidents—89 of them at present, such as Ashley Madison or Adult FriendFinder—as "sensitive breaches." Those records will not appear in a public search; they are only visible if you verify ownership of the email address by receiving a confirmation message in that inbox. That creates a major catch for digital archaeology: if your 20-year-old Hotmail or ISP account is dead and inaccessible, you cannot verify ownership to see sensitive breach hits, nor can you subscribe that dead address to HIBP’s notification alerts, because alerts are strictly sent to the monitored address itself for privacy reasons.
Furthermore, HIBP explicitly warns users against treating a clean search result as a clean bill of health. Because many corporate breaches go undetected, unreported, or privately traded among threat actors without ever being released publicly, HIBP represents only a subset of all compromised records.
- Section Summary: HIBP tracks over 17.8 billion exposed records across 1,046 sites, separating email-address lookups from anonymized password hashes. However, it cannot show sensitive breaches or send alerts for dead email accounts you can no longer access, and an absence of results does not guarantee an account has never been breached.
The Anatomy of Old Exposures: From 2012 LinkedIn to Stealer Logs
When you dig through decades of breach history, not every flagged record carries the same operational risk. Phillips noted that his oldest Hotmail address surfaced in the August 2017 Onliner Spambot dataset—an incident that exposed roughly 711 million unique email addresses used for targeted spam distribution. If an email address like that is permanently defunct, tied to no current services, and used a password you never repeated elsewhere, its presence in a spambot list is largely historical noise.
The equation changes dramatically when an exposed address or password bridges your past to your present. Take the LinkedIn breach Phillips encountered: according to HIBP’s official breach record, LinkedIn was originally compromised in May 2012, but the dataset of approximately 164.6 million email addresses and unsalted SHA-1 password hashes did not surface for sale on a dark-market site until May 2016. Because unsalted SHA-1 hashes were trivial to crack within days of release, those 2012 passwords quickly fed into massive "combo lists" (such as Collection #1) and automated credential-stuffing databases.
Even more concerning in modern breach lookups is the rise of infostealer malware logs. As HIBP explains in its documentation, entries flagged as malware breaches—such as datasets from Emotet or modern stealer logs—do not come from a website getting hacked. Instead, they are harvested directly from infected PCs by malware that records the email address, password, and login URL at the moment a user signs in. If an old or current email shows up in a stealer log, the immediate takeaway isn't just that a password leaked; it is a warning that a Windows PC or other device you used may have been directly compromised.
| Exposure Type | What It Means | Primary Risk to You Today | Recommended Action |
|---|---|---|---|
| Spambot / Scraped List | Email address aggregated into marketing or spam databases (often without passwords). | Targeted phishing, scam lures, and inbox clutter. | Verify scam claims independently; use email aliases for future sign-ups. |
| Historical Site Breach (e.g., LinkedIn 2012) | Service database was compromised; emails and hashed or plaintext passwords leaked. | Credential stuffing against current accounts if you reused that password. | Replace that password anywhere it is still used; enable two-factor authentication (2FA). |
| Combo List / Stuffing Database | Aggregated email-and-password pairs traded by attackers for automated login attempts. | Automated account takeover on services lacking 2FA. | Audit all saved logins with a password manager and eliminate reused credentials. |
| Stealer Malware Logs | Malware on an infected device captured credentials and URLs during login. | Active session hijacking and local PC compromise. | Run a full system malware scan, rotate all saved browser credentials, and revoke active sessions. |
- Section Summary: Old breach hits range from low-risk spam lists to cracked password hashes and device-level infostealer logs. The danger lies in whether an exposed password was reused on active accounts or captured from an infected machine.
Why You Need a Second Opinion: Cross-Checking with Password Managers
Because no single database captures every leak, cross-referencing HIBP with a password manager’s built-in auditing tool is a smart defensive move. Phillips noted that when he ran Google Password Manager’s checkup tool in Chrome, it flagged several single-use throwaway accounts that had not appeared in his HIBP email searches.
Why do these tools return different results? They are looking at different pieces of the puzzle. An HIBP email search checks whether an address string appears in verified public breaches. A password manager checkup evaluates the actual saved username-and-password pairs stored in your vault against its own threat intelligence feeds.
At the same time, browser password audits can generate what look like "false positives" if you don't clean out your vault. If Google Password Manager still holds a four-year-old login for a dead website, or an old password you stopped using elsewhere, it will continue to flag that saved entry as compromised until you update or delete the record from your vault.
How to Run Google Password Checkup on Your PC
According to Google’s official Chrome and Account Help documentation, you can audit your saved credentials on any Windows PC or desktop browser in under a minute:
- In Google Chrome: Open Chrome, click the More menu (the three vertical dots at the top right), and select Passwords and autofill > Google Password Manager. On the left-hand menu, select Checkup.
- In Any Other Browser (such as Microsoft Edge or Firefox): Navigate directly to
passwords.google.com, select Go to Password Checkup, and click Check passwords (you may be prompted to sign in to your Google Account). - Review the Three Categories: Google groups results into Compromised passwords (username and password combinations published online), Reused passwords (the same secret used across multiple sites), and Weak passwords (simple keyboard patterns, single words, or easily guessed phrases).
- Clean Up Dormant Warnings: For active accounts, change the password immediately. If a flagged entry belongs to a dead account that no longer exists, delete the saved credential from your vault—or click More (three dots next to the entry) and select Dismiss warning so your audit dashboard stays accurate.
Google also highlights a critical anti-phishing rule in its documentation: if you ever receive an unexpected notification claiming your password is unsafe, do not click links inside a suspicious email. Instead, navigate directly to Password Checkup yourself to verify whether the alert is authentic.
- Section Summary: Browser and third-party password managers inspect your actual saved credential pairs rather than just your email address, catching reused or weak passwords that an email-only lookup won't flag. Keeping your vault free of dead logins prevents stale warnings.
How Attackers Weaponize Forgotten Credentials—and How to Lock Them Down
When an old credential pair ages out of active use, it rarely disappears. Instead, it gets recycled into two primary attack vectors:
- Automated Credential Stuffing: Attackers load millions of breached email-and-password pairs into automated bots that hammer login pages across banking, retail, gaming, and cloud services. If you used the same password on a forgotten 2015 forum that you currently use on your Microsoft account or primary email, the bot gets right in.
- Psychological Extortion and Phishing: Scammers frequently send emails claiming they have installed spyware on your PC or compromised your webcam, pasting one of your genuine 10-year-old breached passwords into the subject line or body as "proof." While Phillips notes that these spam lures are fake scams designed to panic you into replying or paying a ransom, security best practice is simple: recognize that an old password in an email only proves the sender read an old breach dump, not that they control your current machine. Still, never ignore legitimate security alerts—always verify account status by logging into the service directly through your browser rather than clicking email links.
Your 5-Step Credential Cleanup Checklist
To sever the link between your forgotten internet past and your current digital life, put these five defenses into practice:
- Audit and Close Dormant Accounts: Search your email archives for terms like "Welcome to," "Verify your email," or "Your account" to uncover forgotten sign-ups. If a service is still online and you no longer need it, log in, delete your stored personal data, and permanently close the account.
- Adopt a Dedicated Password Manager: Whether you start with a built-in browser tool like Google Password Manager or move to a dedicated cross-platform vault like Bitwarden or 1Password, let the software generate a long, random, unique password for every single site. If a site gets breached tomorrow, a unique password ensures the blast radius ends there.
- Enforce Two-Factor Authentication (2FA): Both HIBP and Google strongly advise enabling 2FA (or passkeys) everywhere it is supported—especially on your primary email account, which acts as the master recovery key for the rest of your digital identity.
- Subscribe Active Addresses to HIBP Notifications: Register every current email address you can still access on Have I Been Pwned so you receive immediate alerts from
[email][email protected][/email]if your data surfaces in a future leak. - Use Email Aliases for Throwaway Sign-Ups: When registering for a one-off download, forum, or trial service, use an email aliasing service or a dedicated secondary address rather than your primary inbox. If that service gets breached years down the road, you can simply deactivate the alias without exposing your core identity.
- Section Summary: Old passwords fuel both automated credential-stuffing bots and extortion scams that quote leaked secrets to manufacture panic. Closing unused accounts, enforcing unique passwords via a password manager, and locking down active accounts with 2FA removes the leverage from historical leaks.