Ethnicities leaked: what it means and what to do

Risk level: high. Can you change it: no. Found in 10 breaches in this directory.

What this data is

Your recorded ethnic or racial background, often from workplace diversity surveys, health records, government forms, genetic testing services, dating apps and research studies.

The risk on its own

Ethnicity is classed as special category or sensitive information under laws such as GDPR and the Australian Privacy Act, because it can drive discrimination and, in some places, persecution. It cannot be changed. Many people shared it only for a narrow purpose, such as a confidential diversity survey.

The risk combined with other data

With your name, address and employer it enables targeted harassment, hate campaigns and discrimination in hiring or housing. Combined with genetic or health data it can reveal family origins you did not know or chose to keep private. Records from diaspora or community groups can also expose people to pressure from governments in their country of origin.

How criminals use it

  • A hate group compiles a list of people of a particular background from the leak and targets them with abuse.
  • A landlord or employer who obtains the data screens applicants by ethnicity.
  • Scammers impersonate community organisations or officials from your country of origin to extract money or information.
  • Ancestry results tied to your name reveal family origins or relationships you had not disclosed.

What to do now

  1. Ask the organisation which other details were linked to your ethnicity in the breach and how it happened.
  2. Report threats and harassment to police, and keep a record of every incident.
  3. If you face discrimination, contact your human rights or equality body, such as the Australian Human Rights Commission, the EEOC in the US or the Equality Advisory and Support Service in the UK.
  4. Complain to the privacy regulator if the organisation failed to protect sensitive data: the OAIC in Australia, the ICO in the UK or the data protection authority in your EU country.
  5. Review privacy settings on ancestry and genetic testing accounts, and delete data or samples you no longer want stored.

Frequently asked questions

Is ethnicity legally protected information?

Yes. GDPR treats racial or ethnic origin as special category data, and other privacy laws, including Australia's, class it as sensitive, with stricter rules on collection and security.

Why did a company have my ethnicity at all?

Often from a diversity survey, a health or research form or a genetic testing service. You can ask any organisation why it holds the data and request deletion where it is not required.

Can I claim compensation?

In some places, yes. GDPR allows claims for distress caused by a breach, and class actions have followed large breaches in other countries. A privacy regulator or lawyer can advise on your situation.

Breaches that exposed this data

  • Exactis: 2018-06-01, 132M accounts, Credit status information, Dates of birth, Education levels, Email addresses, Ethnicities, Family structure
  • Ashley Madison: 2015-07-19, 31M accounts, Dates of birth, Email addresses, Ethnicities, Genders, Names, Passwords
  • Mate1.com: 2016-02-29, 27M accounts, Astrological signs, Dates of birth, Drinking habits, Drug habits, Education levels, Email addresses
  • Zoosk (2020): 2020-01-12, 24M accounts, Dates of birth, Drinking habits, Education levels, Email addresses, Ethnicities, Family structure
  • Experian (2015): 2015-09-16, 7.2M accounts, Credit status information, Dates of birth, Email addresses, Ethnicities, Family structure, Genders
  • Master Deeds: 2017-03-14, 2.3M accounts, Dates of birth, Deceased statuses, Email addresses, Employers, Ethnicities, Genders
  • Sephora: 2017-01-09, 780K accounts, Dates of birth, Email addresses, Ethnicities, Genders, Names, Physical attributes
  • University of California: 2020-12-24, 547K accounts, Dates of birth, Education levels, Email addresses, Ethnicities, Genders, Job titles
  • University of Nottingham: 2026-06-09, 455K accounts, Academic records, Citizenship statuses, Dates of birth, Disabilities, Email addresses, Ethnicities
  • DC Health Link: 2023-03-06, 48K accounts, Citizenship statuses, Dates of birth, Email addresses, Employers, Ethnicities, Genders

Tools that help

Related guides

Breach data sourced from Have I Been Pwned, used under CC BY 4.0. Additional breach metadata provided by XposedOrNot. DataExposed is an independent service and is not affiliated with or endorsed by either.