A while back I scanned my own Gmail and found 166 companies with my data. I assumed I was an outlier: someone who signs up for everything.
Since then, 415 people have run a GhostSweep scan. So I looked at the anonymous totals to see how unusual I really was. Not very.
How we did this: these are aggregate counts across all 415 scans. No individual's results are shown. Most figures are medians (the middle value), so one extreme inbox can't skew them.
The headline: 137 companies per person
The typical scan found 137 companies holding the person's data. Of those, 48 looked like real accounts (sign-ups, logins, purchases) rather than mailing lists or one-off emails.
And the long tail is long: the top 10% of scans found 463 companies or more.
For context, NordPass's 2026 survey found people believe they manage about 120 personal passwords. Passwords and companies aren't the same thing, but the gap points the same way: most people are tied to more companies than they could name.
The oldest account in a typical scan is about 6 years old
The median oldest account we found was 5.9 years old. That's a floor, not a ceiling: we can only see as far back as someone's inbox goes, and plenty of people have older email addresses they no longer use.
Think about what you signed up for six years ago, and which password you used back then. That account still exists, and it probably still has that password.
12% had an account tied to a known breach
12.3% of scanned users had at least one account we could match to a publicly known data breach. Among those, the typical person had 2.
That's lower than the headlines might suggest, and that's partly the point. No single breach dominated. The most common, Canva and the Twitter leak of 200 million email addresses, each showed up for only about 1% of users. Breach exposure is scattered across hundreds of smaller incidents, which is exactly why it's easy to miss. If you're in that 12%, here's what to do when your email shows up in a breach.
A breach match also isn't the only risk. The other 137 companies still hold your data today, and any of them can be breached tomorrow.
Where the accounts pile up
The share of users with at least one service in each category:
- Productivity & Work: 100%
- Financial & Payments: 93%
- Shopping & E-commerce: 92%
- Social Media: 92%
- Streaming & Entertainment: 88%
- Gaming: 85%
- Email & Communication: 82%
The numbers that stand out are the second and third. More than nine in ten people have financial and shopping services in their inbox, and those are the accounts most likely to store a home address or a saved card. They're the worst kind to forget.
The most common companies
The companies that showed up in the most scans:
- Google: 75%
- Microsoft: 43%
- Discord: 41%
- Instagram: 40%
- Spotify: 39%
- X (Twitter): 34%
- Apple: 33%
- Epic Games: 30%
None of these are shady companies. That's what makes this tricky: the risk isn't one bad actor. It's dozens of ordinary companies, each holding a slice of your life, each with its own vendors, and each one breach away from leaking it.
What this means for you
If the typical person has 137 companies holding their data and you've never checked, you're probably in the same boat. Here's a quick way to start:
- Do the 2-minute privacy audit to see where you stand.
- List your accounts. Do it by hand with our manual method, or run a GhostSweep scan to do it in about two minutes.
- Delete the old ones, starting with financial and shopping accounts. Here's how to delete old online accounts.
We'll update these numbers as more people scan. Want to see whether you're above or below 137? Run a free scan and compare.