Genders leaked: what it means and what to do

What this data is

The gender or sex recorded on your profile, usually picked from a list at signup, sometimes with a title such as Mr or Ms or a gender identity option beyond male and female.

The risk on its own

For most people this is low risk. Gender does not open accounts or prove identity, and it is often obvious from a name or photo anyway. The exception is a record that reveals something a person has not shared, such as a gender identity that differs from their legal documents.

The risk combined with other data

With your name and contact details it slightly sharpens targeting, such as gender specific romance or sextortion scripts. For transgender and non-binary people, a record that links a current identity to a former name or a different recorded sex can lead to outing, harassment or discrimination. That makes the field sensitive for some people even though it is trivial for most.

How criminals use it

• A mismatch between the gender on an account and your legal ID is used to out you to family or colleagues.
• Romance and sextortion scripts are tailored to the gender shown on the leaked list.
• A harasser links a former name and gender on an old account to your current identity.

What to do now

1. For most people no action is needed on this field beyond changing the password on the breached account.
2. If the record could out you, ask the company what was exposed and request deletion of the old profile data.
3. Leave gender blank or choose prefer not to say on sites that do not need it.
4. If you face harassment or threats, keep records, report them to the platform and police, and reach out to an LGBTQ support service.
5. Find old accounts under a previous name and close the ones you no longer use.

Frequently asked questions

Is my gender sensitive information?

For most people it is not. It becomes sensitive when it reveals a gender identity or history someone has not chosen to share.

Why do websites ask for gender?

Mostly for marketing and personalisation. Unless a service genuinely needs it, you can usually skip the field.

Can I have an old gender record corrected or deleted?

You can ask the company to do either. Under laws such as GDPR you have a right to have inaccurate personal data corrected.

Breaches that exposed this data

• Verifications.io: 2019-02-25, 763M accounts, Dates of birth, Email addresses, Employers, Genders, Geographic locations, IP addresses
• Facebook: 2019-08-01, 509M accounts, Dates of birth, Email addresses, Employers, Genders, Geographic locations, Names
• Wattpad: 2020-06-29, 269M accounts, Bios, Dates of birth, Email addresses, Genders, Geographic locations, IP addresses
• Deezer: 2019-04-22, 229M accounts, Dates of birth, Email addresses, Genders, Geographic locations, IP addresses, Names
• National Public Data: 2024-04-09, 134M accounts, Dates of birth, Email addresses, Genders, Government issued IDs, Names, Phone numbers
• Exactis: 2018-06-01, 132M accounts, Credit status information, Dates of birth, Education levels, Email addresses, Ethnicities, Family structure
• LinkedIn Scraped Data (2021): 2021-04-08, 126M accounts, Education levels, Email addresses, Genders, Geographic locations, Job titles, Names
• Badoo: 2013-06-01, 112M accounts, Dates of birth, Email addresses, Genders, Names, Passwords, Usernames
• Evite: 2013-08-11, 101M accounts, Dates of birth, Email addresses, Genders, Names, Passwords, Phone numbers
• Luxottica: 2021-03-16, 77M accounts, Dates of birth, Email addresses, Genders, Names, Phone numbers, Physical addresses
• Under Armour: 2025-11-17, 73M accounts, Dates of birth, Email addresses, Genders, Geographic locations, Names, Purchases
• Tokopedia: 2020-04-17, 71M accounts, Dates of birth, Email addresses, Genders, Names, Passwords

Tools that help

• Email Breach Check
• Privacy Score

Related guides

• Delete Old Accounts You No Longer Use: Find and Close Them
• Online Dating Safety: Verify Matches and Spot Romance Scams
• Google Yourself Safely: Find What Strangers Can See