What Is a Data Breach and What Does It Mean for You?
A plain-English explanation of data breaches: what they are, what kinds of information leak, how criminals use it, and the practical steps to take when a company you use is breached.
You get an email from a company you once shopped with: "We are writing to inform you of a security incident." A data breach means information that an organization held about you has been accessed or leaked without permission. It is not your fault, but it can affect you, and a few steps limit the damage.
What a data breach is
A breach happens when data held by a company, government body, school, hospital or app is exposed. Causes include hackers breaking in, misconfigured databases left open, stolen laptops, insider misuse and mistakes such as emailing a file to the wrong person.
What kinds of information leak
| Data | How criminals may use it |
|---|---|
| Email and password | Trying the login on other sites. See credential stuffing. |
| Name, phone, address | Convincing phishing, scam calls and texts. |
| Date of birth, ID numbers | Identity fraud, account opening, SIM swaps. See leaked ID numbers. |
| Card details | Fraudulent purchases. |
| Purchase or account history | Targeted scams that mention real orders. |
| Health, financial or private messages | Extortion or targeted fraud. |
What to do when a company you use is breached
- Read the company's notice on its official website, not through links in emails, to see what data was involved.
- Change the password for that account and anywhere you reused it.
- Turn on two-step verification on important accounts.
- Watch statements if card or bank details leaked, and tell your bank.
- Consider a credit freeze or fraud alert if ID numbers or dates of birth leaked, where available. See credit freezes explained.
- Expect phishing that uses the leaked details. See phishing that follows a breach.
Our guide to what to do after a breach notification sets out steps by type of data leaked.
You cannot prevent breaches at companies, but you can limit the damage: unique passwords, two-step verification, and sharing less data in the first place.
Reduce your exposure
- Close accounts you no longer use. See deleting old accounts.
- Give companies only the data they need.
- Use email aliases for sign-ups. See email aliases.
Received a breach notice by email? Paste it into CyberWatch AI Scan for a free check. Fake breach notices are a common phishing trick.
For the full guide, see what to do after a data breach in our identity and account security guide.
Frequently asked questions
Is a data breach the same as being hacked?
Not exactly. A data breach happens at a company or organization that holds your data. Your own accounts are not necessarily hacked, but the leaked data can be used to attack them.
How do I know if I was affected?
The organization may notify you, and breach-checking services such as Have I Been Pwned can show whether your email or phone appears in known breaches.
What is the most important step after a breach?
If a password leaked, change it everywhere you used it, and turn on two-step verification. Then watch for phishing that uses the leaked details.
Sources
- Data breach guidance for individuals, UK National Cyber Security Centre
- Data breach recovery, IdentityTheft.gov (US Federal Trade Commission)
- Have I Been Pwned, Troy Hunt
