The Anatomy of a Hit: Decoding "Pwned," "Paste," and "No Record Found"

If you’ve finally worked up the courage to type your email into a breach scanner, you’re usually met with one of three primary outcomes. For most people, the results look like a digital autopsy—fragments of old accounts and forgotten services. But the terminology used by the industry standard, Have I Been Pwned (HIBP), can be confusing.

Understanding the distinction between these results is the difference between an afternoon of mild password updates and a full-blown identity crisis.

Table of Contents

• The Triage: What Your Results Actually Mean
• Deep Dive: "Pwned" vs. "Paste"
• The Danger of "No Record Found"
• The "Freshness" Rubric: When to Worry
• Step-by-Step: Managing a Red Result
• Common Mistakes (and How to Fix Them)
• Summary: The Liquidity of Stolen Data
• Frequently Asked Questions

The Triage: What Your Results Actually Mean

When you hit that search button, the backend isn't scanning the web; it's querying a massive, indexed library of stolen data.

• "Pwned" (The Breach): This refers to a verified, structured data dump from a specific company (e.g., the 2019 Canva breach or the 2021 Facebook leak).
• "Paste": This is a raw, unverified dump found on "paste" sites like Pastebin. These are often smaller, messy, and frequently used by "script kiddies" to brag about a small-scale hack.
• "No Record Found": The "Green" result. It means your email isn't in any of the known databases the scanner has indexed.

Deep Dive: "Pwned" vs. "Paste"

The distinction between a Breach and a Paste is primarily about structure and intent.

The "Pwned" Breach

A breach is usually a corporate failure. A hacker bypasses a database's security and exports a table—often containing millions of rows with columns for emails, passwords (hashed), and names. These are "official" entries because they can be traced back to a specific entity.

The Risk: These are high-value for "Credential Stuffing" bots.

The "Paste"

Pastes are the "bulletin boards" of the hacker world. A hacker might post a list of 500 emails they found on a vulnerable forum or a list of people they’ve successfully phished.

The Risk: These are often targeted. If you appear in a paste, it might mean you were part of a specific group or used a niche service that isn't large enough to be labeled a "Corporate Breach."

The Danger of "No Record Found"

A green result is a relief, but it’s also a dangerous moment for your security hygiene.

The Point of View: A "clean" result is not a clean bill of health; it is a lack of evidence. Many massive breaches (like the "Mother of All Breaches" compilations) take months or years to be discovered and indexed. If you have been phished recently, or if a site you use was hacked yesterday, it won't show up.

"Using a breach scanner to prove you are 'safe' is like checking a 2024 map to see if a new road was built today. It tells you where the holes were, not where they are."

Case Study: The "Combo List" Confusion

A user recently ran a scan and saw "50 Pwned" results. Panicked, they thought 50 of their current accounts were live.

The Reality: 45 of those hits were from a "Combo List"—a compilation of data from breaches dating back to 2012.

The Resolution: Because the user had started using a password manager in 2020, every single one of those passwords was "Stale Debt." They were effectively immune to the breach because the "principal" (the password) had already been paid off.

The "Freshness" Rubric: When to Worry

Use this scoring system to decide how much effort to put into a "Red" result.

Total Score 15+: Change everything. Total Score <10: Document it and move on.

Step-by-Step: Managing a Red Result

If you get a hit, don't just change your password. Follow this "Digital Isolation" process:

1. Read the Breach Description: HIBP tells you exactly what was stolen (e.g., "Passwords," "IP Addresses," "Purchasing History").
2. Determine "Password Reuse": Be honest. Did you use that password anywhere else? If yes, that’s your real "Blast Radius."
3. Kill the Token: Change the password on the primary site AND log out of all active sessions.
4. The "Pivot" Check: If the breach leaked your "Security Questions" (e.g., Mother's Maiden Name), you need to change those on other sites as well.

Common Mistakes (and How to Fix Them)

Summary: The Liquidity of Stolen Data

Stolen data is a currency. It is traded, bundled, and sold in "bulk" until its value drops to zero because everyone has changed their passwords. Your goal is to drain the liquidity of your data. By the time a breach shows up on a scanner, the data is already "public" in the underground. If you’ve already changed your password before the scan result appears, you’ve turned a high-value asset for a hacker into a worthless string of text.

FAQ