How to check if my data was leaked: Polish and global tools

How do I check if my data was leaked?

A data leak is when your data held by a company, shop or online service ends up with people who should not have it. Most often it is an email address with a password, a phone number, a PESEL number (the Polish national ID number), a home address or a scan of an ID document.

You check in two places: the Polish government portal bezpiecznedane.gov.pl and the international service Have I Been Pwned. Both compare your data against leaked databases they have collected. Neither knows every leak, so a nothing found result only means you are not in the databases that were searched.

The third source is the company itself. If you received a breach notice or suspect a leak affected you, ask the company directly which of your data leaked and when.

How to check a data leak with mObywatel and gov.pl

The government service is called Bezpieczne dane (Safe data) and runs at bezpiecznedane.gov.pl. According to the Ministry of Digital Affairs' privacy notice, the Minister of Digital Affairs is the controller, the CSIRT NASK team collects the leaked databases and the Central Informatics Centre (COI) runs the portal.

How it works: go to bezpiecznedane.gov.pl, click log in and confirm your identity through the national login node, for example with a Trusted Profile (Profil Zaufany) or the mObywatel app. According to CERT Polska (page updated 2 September 2026), once logged in you can check your email address, phone number and PESEL. The service is free.

Watch out for fakes. Scammers send emails that threaten a data leak and demand payment. The real portal never asks for money, and you should type its address yourself. You can check the sender's address for free, and read more in how to tell if an email is genuine.

Have I Been Pwned: checking your email address and password

Have I Been Pwned (haveibeenpwned.com) is a free breach search service run by security researcher Troy Hunt. You enter your email address and see the breaches it appeared in, with the date and the type of data.

The Notify me feature emails you when your address shows up in a new breach. According to the service's FAQ, you have to confirm you control that mailbox. A separate service, Pwned Passwords, checks whether a password has appeared in breaches. According to the FAQ, those passwords are stored separately and are not linked to email addresses.

HIBP and the government portal hold different sets of breaches, and neither publishes a full list comparable with the other. That is why you check both places, not one.

Blocking your PESEL in mObywatel: how and what it does

A PESEL block is an entry in the government PESEL Block Register that prevents anyone from signing a credit agreement or similar contract in your name. The service has run since 17 November 2023 under the Act of 7 July 2023 on limiting the effects of identity theft (Journal of Laws 2023, item 1394).

Since 1 June 2024, banks, lending companies, notaries and telecom operators must check the register before signing a contract. According to the Ministry of Digital Affairs this covers, among others, credit and loans, instalment purchases, leasing, notarial deeds for property sales and replacement SIM cards. If an institution grants credit despite the block, the victim does not have to repay it.

How to block your PESEL in the app: log in to mObywatel, tap Services at the bottom of the screen, choose Block PESEL (Zastrzez PESEL) and confirm. You can also do it in mObywatel in the browser on gov.pl or at any municipal office. Blocking and unblocking are free.

You can lift the block temporarily, for example for the day you sign a loan, and restore it just as quickly. You can also see which companies checked your PESEL and why. The ministry recommends keeping your PESEL blocked by default.

What to do after a data leak, step by step

The order depends on what leaked. This list follows CERT Polska's data leak response guide:

1. Find out exactly what leaked: password, PESEL, ID scan, card details. Ask the company if the notice does not say. 2. Password: change it on the affected service and everywhere you used the same or a similar password. 3. Turn on two-step login (2FA), ideally with an app or a hardware key rather than text messages. 4. PESEL: block it in mObywatel. 5. Payment card: block it with your bank and review recent transactions. 6. ID card or passport: register the document as blocked, see below. 7. Be wary of calls and messages from the bank or the police in the following weeks. Fraudsters use leaked data to sound credible.

If the password to a work mailbox leaked, treat it as a company incident rather than a private problem and tell whoever handles IT, because the mailbox can be used to send fake invoices to customers. That scenario is covered in fake invoices and changed bank details. If an API key, token or .env file leaked, you can identify it with the Paste tool, which runs in your browser and sends nothing.

If someone has already used your data, report it to the police. You can file a complaint about a company that failed to protect your data or does not answer your questions with the President of the Personal Data Protection Office (UODO).

Your ID card after a leak: block it or cancel it

Blocking a document means an entry in the Blocked Documents System (Dokumenty Zastrzezone) run by the Polish Bank Association. Banks, mobile operators and other institutions that check customer documents use it. You can block an ID card, passport or driving licence at any bank branch, by phone through your bank, or in the mObywatel app with the Block document service. According to the Ministry of Digital Affairs this is free.

A document block can be lifted if the document turns up. That makes sense for a lost wallet. For a scan circulating in a leak, keep the block in place.

Cancelling an ID card is different: the document stops being valid and you need a new one. According to the gov.pl service, you report it when someone has used your data, for example taken out a loan or signed a phone contract in your name. You can file the report at any municipal office or online, logging in with a Trusted Profile, an e-ID card or a qualified signature. The official cancels the ID straight away, and then you apply for a new one. The service is free.

How to check if someone took out a loan in my name

Credit applications in your name show up in credit and debt bureaus. CERT Polska lists three in Poland: BIK, KRD and BIG InfoMonitor. A report from each shows who asked about your credit history and what debts are recorded under your name.

BIK offers paid BIK Alerts: a text message and email when someone applies for credit using your data. According to bik.pl in October 2026 they cost 48 PLN a year. They complement a PESEL block rather than replace it: the block is free and stops the contract, while the alert only tells you about it.

The Block PESEL service shows the history of checks on your number. A check from a company you never dealt with is a sign someone is trying to use your data. Also review bank statements and the login history in your online banking.