Rise of lookup sites

A new type of search engines, known as "lookups," has flourished on the internet in recent months. These sites do not reference websites like traditional search engines but instead allow users to search for personal data that have been compromised in data breaches. Examples of such sites include BrixHub, SnusBase, Reacher, Stryxx, LeakCheck, and DeHashed.

Services offered by lookup sites

These sites often promise to check whether a user's data have been leaked and, in many cases, offer paid services to delete the data. However, experts warn against using these services, as they do not guarantee the definitive deletion of personal information.

Facilitating fraud and identity theft

According to reports, these lookup sites facilitate fraud and identity theft by making sensitive information accessible. For instance, BrixHub charges users 5 euros to delete 10 files, 8 euros for 20 files, and 200 euros for 1,000 files. The sites are known to change names and disappear only to reappear shortly after, making it difficult for authorities to track and regulate them.

Political and regulatory responses

The phenomenon has drawn the attention of political figures and regulatory bodies. In June 2026, the Renaissance deputy from the Côtes-d'Armor, Eric Bothorel, brought three of these lookups before the courts. More recently, the minister delegate for artificial intelligence and digital, Anne Le Hénanff, took similar action against BrixHub. The CNIL (National Commission on Informatics and Liberty) has expressed concern about the existence of these lookups on social networks, noting that it receives many complaints but struggles to act due to the difficulty in identifying site managers and obtaining responses from hosts.

Harmful effects of lookup sites

These sites are considered harmful for several reasons. They facilitate fraud and identity theft by providing scammers with access to personal information. Additionally, they commercially exploit stolen data, contributing to the proliferation of phishing scams, credit card fraud, and other cybercrimes.

Frequency of data breaches

Personal data leaks have become increasingly frequent, with notable breaches occurring in institutions such as the National Education, the General Directorate of Public Finances, Bloctel, Public Health France, and the Ministry of Ecological Transition during the summer of 2026. Private actors, including internet service providers and commercial stores, have also been affected.

Alternatives to lookup sites

To check if one's data are accessible, experts advise against using lookup services, as they do not comply with data protection legislation and the use of data entered there is unclear. Instead, users are recommended to use the free service Have I Been Pwned, which was founded in 2013 by cybersecurity expert Troy Hunt. While this service is recognized by Australian and American authorities, its database is not exhaustive and may not be up to date.

Legal recourse under GDPR

Under the GDPR (European regulation for data protection), compensation is possible for consumers in cases of personal data theft. However, in practice, it is difficult to obtain, as victims must prove that the organization that was attacked violated the GDPR, that this violation caused a prejudice, and that there is a link between the two. The process involves initiating a procedure before a court, which can be discouraging for victims.