Security questions and answers leaked: what it means and what to do
Risk level: critical. Can you change it: yes. Found in 13 breaches in this directory.
What this data is
The questions and answers used to verify you during password resets or phone support, such as your first pet, first school, favourite teacher or mother's maiden name.
The risk on its own
Security answers are password substitutes, and many people use the same truthful answers everywhere. Once leaked, they can reset accounts without knowing the password. Because many are facts about your life, you cannot change the truth, only what you tell each site.
The risk combined with other data
With your email address and name, security answers allow account recovery attacks on email, banking, telecom and government accounts. Attackers can call support desks and answer identity checks. If the answers match public social media details, they can be reused for years.
How criminals use it
An attacker resets your email account by answering the first pet question from the leak.
A caller passes a bank or phone carrier verification check using your leaked answers.
The same school name answer is tried on shopping, gaming and government accounts.
Your answers are combined with social media posts to guess new security questions.
What to do now
List accounts that use security questions and change the answers, starting with email, banking and your mobile carrier.
Use random answers unique to each account and store them in a password manager.
Switch accounts to stronger recovery methods such as passkeys, authenticator apps or backup codes where available.
Ask your bank and phone carrier to add a verbal password or account PIN.
Check account security settings for recent password resets or changes you did not make.
Frequently asked questions
Should my security answers be true?
No. Use random answers stored in a password manager, because true answers can be found in leaks and social media.
Can someone reset my account with security answers?
Yes, on services that still use them for recovery or phone verification. That is why leaked answers must be changed.
What if a site will not let me change the question?
Change the answer if possible, add two-factor authentication and contact support to request stronger recovery options.
Breach data sourced from Have I Been Pwned, used under CC BY 4.0. Additional breach metadata provided by XposedOrNot. DataExposed is an independent service and is not affiliated with or endorsed by either.