A data breach means information held by a company or organization was accessed, copied, or stolen by someone who should not have had it. It is usually not something you personally caused, but you may still need to respond.
Does this affect you?
Use this if you receive a breach notice, see a breach alert from a password manager, or want to understand what happens when a company loses customer data.
How a data breach happens
Most breaches come from a handful of common paths.
- An attacker gains access through employee phishing, an unpatched vulnerability, weak administrator passwords, or credentials stolen from another breach.
- Once inside, the attacker looks for useful databases such as customer accounts, order history, payment records, or identity information.
- The data may be copied slowly over days or weeks before the company notices.
- The company investigates and eventually notifies affected customers when personal-data exposure is confirmed.
- The stolen information may be sold, leaked publicly, used for identity theft, or used in credential stuffing against other websites.
What to look for in a breach notice
Not every breach has the same level of risk.
- Email addresses and usernames can increase spam and phishing attempts.
- Passwords are more serious, especially if they were stored poorly or reused elsewhere.
- Financial details or card numbers require bank or card monitoring and possible replacement.
- Social Security numbers, driver’s license numbers, or identity documents raise identity-theft risk.
- Dates matter because some breaches are discovered months after the original access.
More control
Change reused passwords everywhere
If the breached password was used on any other site, change it there too. This is the main way one breach spreads into many account takeovers.
Turn on multi-factor authentication
MFA means a leaked or guessed password alone is not enough to sign in. Turn it on for email, banking, password managers, and important accounts first.
Use breach-checking tools
Free tools such as Have I Been Pwned can show whether an email address appears in known breaches, so you are not fully dependent on company notifications.
Sources
- FTC Consumer Advice – Data Breach Response (2025)
- Have I Been Pwned – About This Site (2025)
- CISA – Data Breach (2025)