Phone numbers leaked: what it means and what to do

Risk level: medium. Can you change it: yes. Found in 378 breaches in this directory.

What this data is

Your mobile or landline number, collected at signup for contact, delivery updates, marketing and two-factor codes.

The risk on its own

A leaked number brings unwanted calls and texts, and many numbers were already semi public. The more serious issue is that phone numbers act as login keys: they receive security codes and are used to recover accounts. That makes the number a target, not just a contact detail.

The risk combined with other data

With your name, address and date of birth, a criminal can impersonate you to your mobile carrier and move your number to their SIM. They then receive your text message codes and can reset email and bank passwords. Tied to your name it also powers smishing that addresses you personally and names services you really use.

How criminals use it

  • A criminal calls your carrier, passes their checks with leaked details, and ports your number to a SIM they control.
  • You receive a text claiming a parcel is waiting, with a link to a fake payment page.
  • A caller claiming to be your bank's fraud team uses your name and number to sound legitimate and asks you to read out a code.
  • Your number is looked up on messaging apps to find your profile photo, name and status.
  • Your number is sold to robocall and spam lists, increasing unwanted calls.

What to do now

  1. Ask your mobile carrier to add a port out lock or account PIN, which stops your number being moved without it.
  2. Move important accounts from SMS codes to an authenticator app or passkey.
  3. Turn on silence unknown callers on iPhone, or call screening on Android, and register with your national do not call register.
  4. Hide your number from profile search in WhatsApp, Facebook and other apps under their privacy settings.
  5. Never click links in unexpected texts. Open the company's app or website directly instead.
  6. Remove your number from people search sites and data brokers.

Frequently asked questions

Can someone hack my phone with just my number?

Not usually. The realistic risks are scam calls, phishing texts and a SIM swap, where your number is moved to another SIM.

Should I change my phone number?

Most people do not need to. Lock the number with your carrier, move accounts off SMS codes and filter unknown callers. Change it if harassment continues.

How do I know if my SIM has been swapped?

Your phone suddenly shows no service, and you may get emails about account changes you did not make. Call your carrier from another phone straight away.

Breaches that exposed this data

  • Verifications.io: 2019-02-25, 763M accounts, Dates of birth, Email addresses, Employers, Genders, Geographic locations, IP addresses
  • Data Enrichment Exposure From PDL Customer: 2019-10-16, 622M accounts, Email addresses, Employers, Geographic locations, Job titles, Names, Phone numbers
  • Facebook: 2019-08-01, 509M accounts, Dates of birth, Email addresses, Employers, Genders, Geographic locations, Names
  • Zynga: 2019-09-01, 173M accounts, Email addresses, Passwords, Phone numbers, Usernames
  • Dubsmash: 2018-12-01, 162M accounts, Email addresses, Geographic locations, Names, Passwords, Phone numbers, Spoken languages
  • National Public Data: 2024-04-09, 134M accounts, Dates of birth, Email addresses, Genders, Government issued IDs, Names, Phone numbers
  • Exactis: 2018-06-01, 132M accounts, Credit status information, Dates of birth, Education levels, Email addresses, Ethnicities, Family structure
  • Apollo: 2018-07-23, 126M accounts, Email addresses, Employers, Geographic locations, Job titles, Names, Phone numbers
  • DemandScience by Pure Incubation: 2024-02-28, 122M accounts, Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses
  • B2B USA Businesses: 2017-07-18, 105M accounts, Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses
  • Evite: 2013-08-11, 101M accounts, Dates of birth, Email addresses, Genders, Names, Passwords, Phone numbers
  • 1win: 2024-11-02, 96M accounts, Dates of birth, Email addresses, Geographic locations, IP addresses, Passwords, Phone numbers

Tools that help

Related guides

Breach data sourced from Have I Been Pwned, used under CC BY 4.0. Additional breach metadata provided by XposedOrNot. DataExposed is an independent service and is not affiliated with or endorsed by either.