Look Up: How These Underground Sites Resell Your Stolen Personal Data
French authorities are issuing more and more warnings about "look up" sites. Behind the name are parallel search engines that collect personal information taken in cyberattacks. How do they work? Where does the data come from? What do they cost? Here is what you need to know.
Look up: what is it exactly?
A "look up" is a platform that looks like an ordinary search engine. Instead of indexing web pages, it lets someone retrieve personal information from a few details: last name, first name, email address, phone number, and so on.
According to Damien Bancal, a cybersecurity specialist who writes the Zataz blog, the phenomenon is not new: the first sites of this kind already existed about fifteen years ago.
The results can be highly sensitive:
- postal address;
- date of birth;
- email address;
- bank details (IBAN);
- social security number.
Some of these sites are available on the ordinary web. Others can be reached only on the dark web. Their addresses often circulate on cybercrime forums or through encrypted messaging apps such as Telegram or Signal.
Where does the data used by look up sites come from?
The exact origin of the data is hard to establish. The principle is known, though: these platforms compile information taken from data breaches.
The CNIL, the French data protection authority, explains that these services generally aggregate data from breaches at companies, public bodies or other organizations.
One site consulted by AFP says it works from "databases that come from third-party leaks."
These databases can be:
- bought directly by the people who run the look up sites;
- picked up for free on specialized forums;
- resold or traded among cybercriminals.
"There are dozens of forums where data files, old or recent, circulate and can be downloaded for free," Damien Bancal notes.
How do these sites make money?
Most look up sites offer a few free searches to attract visitors. They then sell a look up subscription that unlocks unlimited queries.
On two sites consulted by AFP, monthly prices ranged from 10 to 15 euros. One of them even offered a paid option, starting at 11 euros, to request the deletion of your own data.
| Type of access | Price observed | Note |
|---|---|---|
| Free searches | €0 | Limited number |
| Monthly subscription | €10 to €15 | Unlimited queries |
| Deletion of your data | from €11 | Strongly discouraged |
Faced with these practices, the junior minister for Digital Affairs, Anne Le Hénanff, issued a clear warning: never pay to have your personal information removed. She also said she had referred the matter to the courts.
What are the risks for victims and users?
For the CNIL, these services do not comply with the law. The authority advises against using them, even to check whether your own data appears there.
The reason is simple: when you type a query, you leave information that can later be used without your knowledge.
The risks are numerous:
- identity theft;
- phishing;
- bank fraud;
- abusive solicitation;
- blackmail or extortion;
- handling stolen data.
People whose information appears on these platforms can also be targeted by highly specific scams.
What is the French justice system doing?
The CNIL says it regularly forwards these reports to prosecutors. The cybercrime prosecutor's office has already been seized for several platforms of the same kind.
Between February and October 2026, the cybercrime section of the Paris prosecutor's office opened about ten criminal investigations into sites that aggregate stolen data.
In June, member of parliament Éric Bothorel also reported three sites compiling data leaks, referring to a possible offense of handling stolen data.
More recently, Nicolas Guidoux, head of the Anti-Cybercrime Office (Ofac), announced on LinkedIn the first takedown of a look up site in France. Three people, aged 17 and previously unknown to the justice system, were arrested. The site was shut down.
How can you protect yourself from look up sites?
There is no magic way to disappear completely from these databases. Several habits do limit the risk.
1. Never pay to have your data deleted
Paying a look up site often means funding an illegal activity, and nothing guarantees that the information will actually be deleted.
2. Do not use these sites yourself
Even a simple search can feed their databases or expose information about you.
3. Strengthen your accounts
- use long, unique passwords;
- turn on two-factor authentication (2FA);
- check your bank statements regularly;
- be wary of suspicious emails and text messages.
4. Use your GDPR rights
You can ask the organizations that hold your data for access or deletion, when that is possible.
5. Report illegal content
You can report a suspicious site to the CNIL, to Cybermalveillance.gouv.fr, or to the police.
FAQ: common questions about look up sites
Is a look up site legal?
No. For the CNIL, these services do not appear to comply with personal data protection law.
Can you ask a look up site to delete your data?
Paying for that is discouraged. It is better to use legal channels and report the site to the competent authorities.
Should you check whether your data is on a look up site?
The CNIL advises against it, because you may yourself supply information that can be exploited.
What should you do if your data has leaked?
Change your passwords, turn on two-factor authentication, watch your bank accounts and report any suspicious attempt.
What to remember
- Look up sites are underground search engines fed by data breaches.
- They can surface highly sensitive information: IBAN, address, date of birth, social security number.
- Their model often relies on subscriptions of 10 to 15 euros a month.
- The CNIL advises against using them, even to check your own data.
- French prosecutors opened about ten investigations between February and October 2026.
- A first takedown has taken place in France, with three arrests and the closure of a site.
The best reflex is still prevention: protect your accounts, never pay to have your data removed, and report suspicious platforms to the authorities.