A breach date is not a current password

The date belongs to the listing

A breach-monitoring page can show a breach name and a date next to an address you checked, your own or one on a domain you verified. That date is what the listing displays. It is not the day the mailbox was created, and it is not a password.

If the page does not show a date, write “breach date not shown.” Do not invent one from the breach name.

The listing is not the secret

The service telling you an address appeared does not hand you a password in this note, and you do not go collect a stolen dump to “see the password.” The defensive record is the address, the breach name, and the date on the listing.

Whether a password is still the one someone uses is a separate fact from the account owner or from the identity provider. The listing date does not decide it.

What to write down

File the address you were allowed to check, the breach name, and the date the page showed. State that no dump was downloaded. A reset recommendation, if you make one, is a recommendation, not a claim that you saw the password.

Lab: a 2019 listing read as today’s password

Your own address appears in a listing named LabForum, date shown 2019-04-02. A draft says the password you use today was taken in that breach and should be pasted into the ticket for the reset team.

The note quotes LabForum and 2019-04-02 as the listing. No password is in the note. No dump is downloaded. Any reset is described as a precaution the account owner can take, not as proof of the current secret.

address checked: your own
listing: LabForum
date shown: 2019-04-02
password in the note: none
dump downloaded: no
write: listing and date
not: today’s password was captured