There's a simple zero knowledge proof to show that you actually have the data. Have a CSV of username + salt + hashed(salt + email) + hashed(salt + phone number

There's a simple zero knowledge proof to show that you actually have the data. Have a CSV of username + salt + hashed(salt + email) + hashed(salt + phone number) , etc. Users can check their own email/phone/etc to verify that the attacker has the data, without the attacker revealing the data. I'm surprised this doesn't happen more.