What a breach is
A data breach happens when information held by an organisation is accessed, copied or exposed by someone who should not have it. The organisation might be a retailer, a medical provider, a government body, a school, a social network or a small business. The information might be copied by an attacker, left in an unprotected storage location, or sent to the wrong recipients by mistake.
Hearing about a breach can feel abstract, since nothing seems to change on your own devices. The consequences, if any, usually appear later and indirectly, which is why it helps to understand the path from a leak to a scam.
How breaches happen
Breaches have a handful of recurring causes.
- Stolen or guessed credentials. Attackers log in with passwords obtained through phishing, malware or earlier leaks. Because many people reuse passwords, one exposed password can open several accounts.
- Unpatched or misconfigured systems. A known weakness in software that has not received software updates, or a database set up so that it is reachable without a password, can allow access.
- Malware, including ransomware. Some attacks lock systems and also copy data first, using the threat of publication as extra leverage.
- Third parties. A supplier, contractor or service provider holding data on behalf of another organisation may be the weak point.
- Human error and insiders. Misdirected emails, lost devices and staff misusing access all cause exposure.
- Social engineering. Tricking an employee into giving access is often easier than breaking technical defences.
The organisation holding your data usually decides how well it is protected, which means individuals have limited control over whether a breach happens.
What data tends to leak
What is exposed depends on what the service held. Common categories include:
- Contact details: names, email addresses, phone numbers and postal addresses.
- Account information: usernames, and passwords, which should be stored in a scrambled form called a hash. Hashing makes passwords harder to read, but weak passwords can still be worked out, so it is not a complete protection.
- Personal identifiers: dates of birth and, in more serious cases, government identification numbers.
- Financial data: partial card details or billing information. Complete card details are more tightly controlled in many systems, though not all.
- Behavioural or private data: purchase history, messages, location, health or employment information.
Not all breaches are equal. An exposed email address in a large list is a minor problem compared with exposed identity numbers, medical details or login credentials.
How exposed data is used
Leaked data often ends up being traded or combined with other leaks. Collections of exposed information can be merged with details gathered by data brokers, producing detailed profiles. Over time, this feeds several kinds of misuse.
- Targeted phishing. A message that uses your real name, your actual bank or a recent purchase appears more believable. This is a main reason breaches lead to more convincing phishing scams.
- Credential stuffing. Attackers try leaked email and password pairs on other sites, relying on reuse. Success can lead to account takeover.
- Identity theft. Combined details such as name, birth date and address may be used to open accounts or apply for credit in someone else’s name.
- Impersonation of you. Details can help a fraudster answer security questions with a bank or mobile carrier, which links to SIM swapping.
- Spam and unsolicited contact. Exposed phone numbers and email addresses often lead to more nuisance messages.
- Extortion attempts. Some fraudsters email people claiming to hold embarrassing material and quoting a real leaked password. The password may be genuine, but the claim of having watched you usually is not. Do not pay, and change any password you still use.
Exposure does not mean every one of these will happen. Many leaked records are never used against their owners, but there is no reliable way to know in advance, so it is sensible to assume that the details could be reused.
Finding out whether you are affected
Organisations that suffer a breach are often legally required to notify affected people, depending on where they operate, though timing varies. Breach notifications themselves are sometimes imitated by scammers, so treat any such email with care: do not follow its links, but visit the organisation’s website directly, or open its official app, to find the announcement.
Some reputable services let you enter an email address to see whether it appears in known leaks. Use only well-established ones, and be aware that no such service sees every breach.
What to do afterwards
The right response depends on what was exposed, but a calm, ordered approach generally covers these points.
- Change the affected password, and any other account that used the same one. Make each new one unique. A password manager makes this realistic.
- Turn on two-factor authentication, preferably through an authenticator app, because texted codes are weaker against SIM swapping.
- Check your accounts and statements for activity you do not recognise, and tell your bank if card details were involved.
- Consider fraud alerts or a credit freeze if government ID numbers or similar identifiers were exposed. These are explained in more detail elsewhere on this site, and availability depends on your country.
- Be wary of follow-up contact. Expect more convincing messages, and verify by contacting the organisation through its official channels.
- Keep records of notices and anything you do, in case you need to report a problem later.
Reducing the impact of future breaches
You cannot stop an organisation from being breached, but you can limit what each breach reveals: use unique passwords, give out only the information a service really needs, use separate email addresses or aliases for different purposes where practical, and delete accounts you no longer use. Reviewing a service’s privacy policy and data protection laws in your region can also tell you what rights you have to see or delete your data. These habits do not prevent a breach, but they reduce how much a later scammer has to work with.