Reading Leaks & breaches results

Running a Public Leaks search populates the Search Results panel on the right of the composer. This page explains how to read and verify that result set. Leaks results follow the same reading model as every Search type, so this page leans on the general Found, Enriched & Connections concept for the shared mechanics and calls out what is specific to breach data.

Caution

No populated results screenshot exists for the Public Leaks Search type. The counters, columns and Details panel described below are drawn from the general results model (captured for Username Intelligence and OneScan runs) and applied to leaks by reference. The exact column set a leak Module returns is not yet captured — confirm against the app.

The three counters

Every populated results header carries the same trio of counters, in this order, counting three different things (never interchange them):

• Found (green) — the identifier was located in a data source. For a leak search this means your value appears in that source’s leak/breach data.
• Enriched (orange) — UserSearch holds further metadata on that hit (such as associated names or linked identifiers). Enriched is a strict subset of Found.
• Connections (white) — relationships/links surfaced between entities, intended to populate the Connections graph.

See The three counters for the full definitions and captured examples.

Caution

A populated Connections graph has never been captured in any Search type — in every captured state the connections detail area reads “No connections found”, and the counter can be non-zero while the section is empty. Do not expect a rendered leaks connections graph as a guarantee.

The results table

The results panel has Search Results and Bookmarks tabs. Its header pins the Found / Enriched / Connections counter tiles top-right, and offers action buttons — AI Analyse, AI Ask, Export and Clear — plus (in some states) a Filter control that narrows the visible rows.

The results table adapts its columns to the Module that produced them:

• For a single-source leak Module (such as IntelX), expect a per-source column layout built around the found sites/hits.
• For OneScan, expect a Data Source column that attributes each row to the specific leak source it came from — the value of running a multi-source scan.

Caution

The precise columns a Public Leaks Module returns were not captured. The two column sets observed elsewhere were BOOKMARK · SITE · ENRICHED · CONNECTION · PROFILE URL (the 3000+ sites username Module) and BOOKMARK · ENRICHED · FOUND ON · DATA SOURCE (OneScan). A leak Module’s columns may differ; read them in the app. See Columns adapt to the Module.

The Details panel

Selecting a row drives the Details panel below the table. It organises the row’s structured detail into tabs (Details, optionally Profile View, and Graph) and, within the Details tab, a stack of labelled sub-sections — a search summary, connection tables, and, where a hit is enriched, an INFORMATION block carrying the enrichment metadata. For the full anatomy see The Details panel.

Verifying a leak hit

• A Found result confirms the identifier appears in that data source’s leak data — it is that source’s report of an exposure, not independent proof of a live account.
• Any Match Accuracy figure shown is set by the third-party data source, not computed by UserSearch (per Lee, 2026-07-08). Treat it as that source’s own confidence figure.
• Cross-check exposures across Modules: an IntelX hit and a HaveIBeenPwned hit for the same value corroborate each other. Running OneScan does this cross-checking in one pass, with the Data Source column showing which sources agree.
• Use the Google “G” pivot icon beside a searched value to open Google with a preset dork for that value (per Lee, 2026-07-08) and pursue the exposure further.

Note

A second small magnifier / enrich pivot icon sits beside the Google “G”. Like the “G”, it opens Google with a preset dork for the value (per Lee, 2026-07-10) — a companion external-Google pivot, not a separate in-platform action.

Caution

Whether leak data sources return passwords or other sensitive credentials in full, or redact them, was not confirmed. Do not rely on any redaction behaviour as a guarantee; handle any exposed data according to your own policy.

Related

• Leaks & breaches search: overview — what the Search type is for and the end-to-end flow.
• Leaks & breaches modules & options — the Modules that produce these results.
• Reading Results — Found, Enriched & Connections — the full, captured results model this page builds on.

Verified against UserSearch v2.0.20