Bank account numbers leaked: what it means and what to do
Risk level: critical. Can you change it: yes. Found in 13 breaches in this directory.
What this data is
The number that identifies your account at a bank, usually stored with a sort code, routing number or BSB so a payment can be made or collected.
The risk on its own
An account number alone does not let anyone log in or drain your balance, and honest advice starts by saying so. What it does allow is collection: in many countries a direct debit can be set up with an account number and a name. It also gives a scammer the single most convincing detail they can quote to you.
The risk combined with other data
With your name, address and date of birth, the account number supports full financial impersonation. That combination passes many telephone banking checks and supports applications for credit in your name. It also makes the fake bank fraud team call almost impossible to distinguish from a real one.
How criminals use it
Unauthorised direct debits are set up against the account and run for months before anyone notices.
A caller reads your correct account number back to you as proof they are from the bank, then talks you into moving money to a safe account.
Your account is used as a mule destination in another fraud, which drags you into the investigation.
The number is used with other leaked details to pass a telephone identification check and add a new payee.
What to do now
Log in to online banking and review every direct debit and standing order, cancelling anything you do not recognise.
Turn on alerts for all outgoing payments, not just large ones, so unfamiliar collections show up the same day.
Phone your bank on the number printed on your card, tell them the number was breached and ask what extra verification they can add.
Change your online banking password and move that account off SMS codes to an authenticator app or in app approval.
Ask about a new account number if fraudulent debits have already appeared, since a fresh number ends the exposure.
Put a freeze or a fraud alert on your credit file so applications using your details are blocked.
Frequently asked questions
Can someone empty my account with just the number?
No. Withdrawing money needs access to your login or your card. The realistic risks are unauthorised direct debits and highly convincing scam calls.
Should I close the account?
Not automatically. Start with a full direct debit review and alerts. Change the number if fraudulent collections have already been attempted.
My employer has my account number anyway. Why is a leak different?
Because a leak puts it beside your name, address and contact details in a file criminals can search, which is what turns it into a targeting tool.
Breaches that exposed this data
Paidwork: 2026-03-29, 23M accounts, Bank account numbers, Dates of birth, Device information, Education levels, Email addresses, Financial transactions
Free: 2024-10-17, 14M accounts, Bank account numbers, Dates of birth, Genders, Names, Phone numbers, Physical addresses
Unverified Data Source: 2021-01-26, 11M accounts, Bank account numbers, Credit status information, Dates of birth, Email addresses, Employers, Health insurance information
Angel One: 2023-04-01, 6.8M accounts, Bank account numbers, Dates of birth, Email addresses, Financial investments, Government issued IDs, Names
Odido: 2026-02-12, 6.1M accounts, Bank account numbers, Customer service records, Dates of birth, Driver's licenses, Email addresses, Genders
Bouygues Telecom: 2025-08-04, 5.7M accounts, Bank account numbers, Dates of birth, Email addresses, Names, Phone numbers, Physical addresses
Ticketcounter: 2021-02-22, 1.9M accounts, Bank account numbers, Dates of birth, Email addresses, Genders, IP addresses, Names
Oxfam: 2021-01-20, 1.8M accounts, Bank account numbers, Dates of birth, Email addresses, Genders, Names, Partial credit card data
La Poste Mobile: 2022-07-04, 534K accounts, Bank account numbers, Dates of birth, Email addresses, Genders, Names, Phone numbers
GoldSilver: 2018-10-21, 243K accounts, Bank account numbers, Email addresses, IP addresses, Names, Partial credit card data, Passport numbers
Upstox: 2021-04-08, 111K accounts, Bank account numbers, Dates of birth, Email addresses, Family members' names, Genders, Government issued IDs
Qatar National Bank: 2015-07-01, 89K accounts, Bank account numbers, Customer feedback, Dates of birth, Financial transactions, Genders, Geographic locations
Breach data sourced from Have I Been Pwned, used under CC BY 4.0. Additional breach metadata provided by XposedOrNot. DataExposed is an independent service and is not affiliated with or endorsed by either.