Risk level: high. Can you change it: no. Found in 3 breaches in this directory.
What this data is
Text messages stored by a phone provider, messaging gateway, business system or app, including personal chats, alerts, verification codes and appointment reminders.
The risk on its own
Texts can contain private conversations, addresses, one time codes, bank alerts and password reset links. Old codes usually expire, but reset links and personal details may still be useful. They also show who you communicate with and when.
The risk combined with other data
With your phone number and name, leaked SMS reveals which banks, services and people you deal with. Attackers can build convincing smishing messages that match real alerts you receive. Any passwords, account numbers or reset links in the texts may lead directly to account takeover.
How criminals use it
A scammer copies the wording of your bank's real text alerts to send a fake fraud warning.
An old password reset link in leaked texts is used before it expires.
Private texts are used to extort you or embarrass you with contacts.
Messages reveal your appointments or travel, helping someone know when you are away.
What to do now
Search your texts for passwords, account numbers and reset links, and change those accounts now.
Move important accounts from SMS codes to an authenticator app or passkeys.
Ask your carrier to add a port out lock or account PIN.
Treat texts that match your usual alerts with caution, and open the official app instead of links.
Delete old sensitive texts and avoid sending passwords or ID numbers by SMS.
Frequently asked questions
Can leaked one time codes be used?
Most codes expire quickly, so old codes are rarely useful. Reset links and account details in texts can be more dangerous.
Should I stop using SMS for two-factor authentication?
Use an authenticator app or passkeys for important accounts where possible. SMS is better than nothing, but it can be intercepted or phished.
How can I tell if a bank text is fake?
Do not use links or numbers in the text. Open your banking app or call the number on your card.
Breach data sourced from Have I Been Pwned, used under CC BY 4.0. Additional breach metadata provided by XposedOrNot. DataExposed is an independent service and is not affiliated with or endorsed by either.