Data breaches
What happens when a company leaks your data, what criminals do with it, and a calm step-by-step plan for the day you get a breach notification letter.
What counts as a data breach
A data breach is any incident where information leaves an organization's control without permission. It can be a criminal intrusion, a misconfigured cloud storage bucket left open to the internet, a lost laptop, an insider copying records, or a supplier that gets hacked. You usually find out from a notification letter or email, a news story, or a service like Have I Been Pwned.
What gets exposed, and why it matters
| Data exposed | Main risk | What to do |
|---|---|---|
| Email address only | More phishing and spam | Be extra alert to messages that mention the breached company |
| Email + password | Account takeover, also on other sites | Change that password everywhere you reused it, turn on 2FA |
| Name, address, phone | Targeted phishing, scam calls | Expect convincing calls; verify independently |
| Date of birth + Social Security number | New-account identity theft | Freeze your credit with all three bureaus |
| Card number | Fraudulent purchases | Ask your bank for a new card, watch statements |
| Bank account details | Fraudulent debits, scam calls | Alert your bank, monitor closely |
| Health or insurance records | Medical identity theft, embarrassment, extortion | Review insurer statements for care you never received |
| Photos of ID documents | Identity fraud | Freeze credit; report to the issuing agency if advised |
Passwords stored properly (salted and hashed with a slow algorithm) are much harder to crack than ones stored in plain text or with weak hashing, which is why breach notices often specify how passwords were protected.
Where stolen data goes
Breached data is sold or traded on criminal forums, then combined with other leaks into large "combo lists". Years after a breach, the same records are reused for credential stuffing, targeted phishing and identity fraud. That is why old breaches still matter and why unique passwords are so important.
The breach notification plan
- Read the notice carefully and confirm it is genuine: check it on the company's official website rather than clicking links in the letter or email. Scammers send fake breach notices too.
- Change the password for that service and anywhere you reused it. A password manager makes this fast.
- Turn on two-factor authentication or a passkey for that account.
- If your Social Security number was exposed, freeze your credit at Equifax, Experian and TransUnion. It is free in the US and does not affect your score.
- Accept free monitoring if offered, but treat it as an alarm, not protection: a freeze prevents fraud, monitoring only tells you after it happens.
- Watch statements for bank, card and insurance accounts for the next months.
- Be on high alert for scam calls and emails that mention the breach. Criminals often impersonate the breached company or a "breach settlement" office.
Class actions and settlements
Large breaches sometimes lead to settlements where affected people can claim money or services. Only file claims through the official settlement website listed in court documents or covered by reliable news outlets; fake settlement sites are a known scam.
Set a yearly reminder to check your email addresses on Have I Been Pwned and to pull your free credit reports at AnnualCreditReport.com, the official US site.