Data breach

What it is

Breaches can involve hackers, lost devices, misconfigured cloud storage, or insider misuse. The exposed data might include emails and passwords, payment cards, health records, or full identity documents.

You usually learn about a breach from a company notice, news coverage, or monitoring that finds your details in a dump — sometimes months after the intrusion.

How it works

1. Intrusion or error — Attackers exploit a weakness, or data is left exposed.
2. Exfiltration — Records are copied out.
3. Discovery — The organization (or a researcher) detects the incident.
4. Notification — Customers are told what categories were involved.
5. Aftermath — Credential stuffing, phishing that references the breach, and identity fraud risk rise.
6. Dark — web markets often redistribute breach corpora long after headlines fade.

Red flags

• Official email/letter stating your data was involved
• Password resets forced by a service you use
• Sudden stuffing attempts on unrelated sites
• Phishing that references the breached company to sound legit
• New-account credit activity after an SSN exposure
• Dark-web monitoring alerts for your email or phone

What to do if you’re targeted

• **Read the notice** for what data types were involved — password vs SSN changes the response.
• **Change passwords** on that site and anywhere you reused them; enable MFA.
• **For SSN/financial PII:** watch credit, consider a freeze, and be alert for tax fraud.
• **Ignore unexpected breach support calls** that ask for payment or remote access — verify through official channels.
• **Retain the notice** for disputes and IdentityTheft.gov if fraud follows.
• **Optional:** free identity scan and ongoing dark-web monitoring; identity theft insurance up to $1M is subject to policy terms.

Related terms

• Dark web
• Credential stuffing
• Identity theft