What a data breach is
A data breach happens when information that should have been kept private is seen, copied or taken by someone who was not meant to have it. It can be deliberate, such as a criminal stealing a customer database, or accidental, such as a file being left open to the public by mistake. The word covers both.
Breaches are usually reported when a company discovers one, or when a researcher or journalist finds data on sale or posted online. Notices often arrive weeks or months after the incident, and the first reports may be incomplete.
Why companies hold so much data
Most online services store accounts: names, email addresses, passwords in some protected form, order histories, and sometimes payment or identity details. Retailers, health providers, schools, banks, travel firms and apps all hold such records. Each database is a single place where many people’s details are gathered, which makes it an attractive target.
Common ways breaches happen
Stolen or guessed credentials. Attackers may log in with legitimate usernames and passwords, obtained from earlier leaks or phishing. Because many people reuse passwords, a leak at one service can open doors at others. This is known as credential stuffing.
Phishing and social engineering. Employees can be tricked into entering their passwords on a fake page or into sending data to someone pretending to be a colleague. The signs are described in the article on phishing emails.
Unpatched software. Servers and applications sometimes have known flaws. If a company is slow to apply fixes, attackers scan for those weaknesses and exploit them. This is why software updates matter for organisations as much as individuals.
Misconfiguration. A cloud storage area or database set to public access by mistake can expose records to anyone who finds it, with no hacking needed. The risks in using cloud storage are mostly about setup and access control.
Insider actions. A current or former employee may misuse access, either on purpose or by carelessness, such as losing a laptop or emailing a file to the wrong person.
Third-party suppliers. A company might be secure itself but share data with a vendor that is not. A breach at a supplier can expose the customers of many businesses at once.
Malware and ransomware. Malicious software can copy data before locking systems and demanding payment. Criminals may threaten to publish what they took.
Lost or stolen devices and paper records. Unencrypted laptops, drives and printouts can also count as breaches.
What leaked data is used for
What happens next depends on what was exposed.
- Email addresses and phone numbers feed spam, scams and targeted phishing. A message that mentions a real purchase or service you use is more convincing.
- Passwords, even if stored in scrambled form, can sometimes be cracked, particularly if they are short or common. Criminals try them on other sites.
- Names, addresses and dates of birth help with impersonation and identity fraud, especially when combined with other leaked records.
- Payment card details can be used for fraudulent purchases, although card issuers often detect and reverse these.
- Health, legal or private messages carry personal and reputational harm that cannot be easily repaired.
- Combined datasets. Leaked records are often merged with information from other sources, a process similar to how data brokers build profiles.
Not everyone whose data is exposed is harmed, and the risk varies a lot depending on the data type. But exposure cannot be undone, because copies spread quickly, which is one reason old leaks continue to cause trouble.
Checking whether you were affected
Several free services let you enter an email address to see whether it appears in known public breaches. Use well-known and reputable ones, and be wary of unsolicited messages claiming you were breached, which may themselves be scams. When a company sends a notice, go to its website by typing the address yourself rather than clicking links in the message.
What to do after a breach
The right steps depend on what was exposed. A sensible order:
- Read the notice to see what data was involved.
- Change the password for that account and any other account that used the same one. A password manager makes unique passwords practical, and a password generator can create strong ones.
- Turn on two-factor authentication, or consider passkey sign-in where available, since a stolen password alone then becomes less useful.
- Watch your accounts for unusual activity, especially if financial details were involved. Contact your bank or card issuer if something looks wrong.
- Consider a credit freeze or fraud alert if identity details such as national ID numbers were exposed. Availability and procedures differ by country, so look to official sources.
- Be alert to follow-up scams. Expect messages that use the breach as a hook.
- Close accounts you no longer use, so there is less data to leak next time.
Reducing your exposure in future
You cannot control a company’s security, but you can limit what it holds about you. Share only the details a service needs, avoid reusing passwords, and use separate email addresses for sign-ups if you want to trace the source of spam. The broader picture of what is collected and who gathers it is outlined in the overview of online privacy, and the wider habits for staying safe belong under online safety.