Checking whether an account appears in a data breach

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. A breach-checking website asks what you should enter to see if your account was in a known data breach. Which is right?

A Your email address and your current password

B Only your email address

2. Your email address appears in the results of a breach checker. What does this tell you?

A Your device has been hacked right now

B Your details were in a known data breach, so you should act

3. The breach checker says the breach included the site 'GameZone'. What should you do next?

A Change the password for your GameZone account

B Delete your email address

4. A breach checker shows 'No breach found' for your email address. What does that mean?

A Your email was not in any known breach in its list

B Your accounts can never be hacked

5. Which is a safe way to use a breach checker?

A Use a trusted checker and type only your email address

B Use any site from a pop-up ad that asks for your password

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1breach checker		AAlert: breach found -> change password
2Result: found in 2 breaches		BA website or alert that tells you if your email address appeared in a known data breach
3A breach checker only needs your email address, never your password		CIgnoring a 'found' result leaves the leaked password working for attackers. The password should be changed.
4After a breach alert, change the password for the affected account and any account that reuses it		DYour email address was in leaked data, so you should change the password for each affected account
5Enter email: sam@example.com Enter password: Tiger123		EEnter email: sam@example.com
6Result: found in a breach Action: ignore it, nothing to do		FA breach checker should only ask for your email address. Typing in your password gives it to a site that could be fake.

Definitions

breach checker

Fill in the Blanks

Complete each line of code by filling in the missing parts.

INPUT email result ← ___________(email) OUTPUT result

IF email __ breachList THEN OUTPUT "Change your password" END IF

IF found = ____ THEN OUTPUT "Change your password now" END IF

FOR EACH account IN affectedAccounts ______________(account) NEXT account

INPUT _____ result ← checkBreach(email) OUTPUT result

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A enter email and password

B result = check(email)

C if result == "found":

D change_password()

Question 2

A email = "sam@mail.com"

B result = check(email)

C if result == "found":

D ignore_result()

E else:

F print("No action needed")

Question 3

A email = "mia@mail.com"

B result = check(password)

C print(result)

Question 4

A result = check(email)

B if result == "found":

C keep_password(account)

D else:

E print("Not in a breach")

Question 5

A result = check(email)

B if result == "found":

C print("You are safe")

D else:

E print("Not found")

Answer Key

Checking whether an account appears in a data breach

Section A: Quick Questions

B — Only your email address

B — Your details were in a known data breach, so you should act

A — Change the password for your GameZone account

A — Your email was not in any known breach in its list

A — Use a trusted checker and type only your email address

Section B: Match the Pairs

breach checker → A website or alert that tells you if your email address appeared in a known data breach

Result: found in 2 breaches → Your email address was in leaked data, so you should change the password for each affected account

A breach checker only needs your email address, never your password → Enter email: sam@example.com

After a breach alert, change the password for the affected account and any account that reuses it → Alert: breach found -> change password

Enter email: sam@example.com Enter password: Tiger123 → A breach checker should only ask for your email address. Typing in your password gives it to a site that could be fake.

Result: found in a breach Action: ignore it, nothing to do → Ignoring a 'found' result leaves the leaked password working for attackers. The password should be changed.

Section C: Definitions

breach checker — A website or alert that tells you if your email address appeared in a known data breach, so you can change the password for any affected account.

Section D: Fill in the Blanks

INPUT email
result ← checkBreach(email)
OUTPUT result

IF email IN breachList THEN
  OUTPUT "Change your password"
END IF

IF found = TRUE THEN
  OUTPUT "Change your password now"
END IF

FOR EACH account IN affectedAccounts
  changePassword(account)
NEXT account

INPUT email
result ← checkBreach(email)
OUTPUT result

Section E: Spot the Error

A — A breach checker needs only your email address. You should never type your password into it. Line 1 should be: enter email address only.

D — If the email was found in a breach, you must change the password for the affected account. Ignoring the result leaves the account at risk. It should be change_password().

B — A breach checker looks up your email address, not your password. Line 2 should be result = check(email).

C — When the result says the email was found, the affected account's password must be changed, not kept. It should be change_password(account).

C — When the result is found, the email appeared in a known breach, so the message must say so, not that you are safe. It should be print("Found in breach").