What is a data breach, and what do I do if my information is in one?

More context

A data breach is what happens when an organisation that holds personal information loses control of it. The information leaks out of their systems — through a hack, a misconfigured database, a stolen laptop, a malicious insider — and ends up where the organisation never meant it to be: a paste site, a forum, a dark-web marketplace, sometimes the homepage of a news site.

What is usually in a breach, in rough order of seriousness:

• Email addresses and usernames. Almost every breach includes these. Useful to attackers mostly as a key for the next dataset.
• Passwords. Sometimes in plaintext (rare and inexcusable), often as hashes (which need to be cracked but very often are), sometimes properly hashed with bcrypt or Argon2 (best case — but the strongest hash is no protection if the password itself was weak).
• Phone numbers and physical addresses. Useful for SIM-swap attacks, targeted package fraud, and crafting convincing phishing.
• Dates of birth, government IDs, social security numbers. Long-lived data you cannot really “change”, which makes these leaks particularly painful.
• Credit-card numbers and bank details. Increasingly rare in modern breaches because payment processors handle them separately, but it still happens.
• Health data, dating profiles, private messages. When breaches hit those, the damage extends beyond the financial.

A data breach is not the same as fraud. The breach is the leak. Fraud — credit-card misuse, account takeover, identity theft — is what attackers do with the leaked data afterwards. Many breached datasets are years old by the time anyone uses them against you. The two famous large databases — the “Collection #1-5” set (2019) and the “RockYou2024” file with ~10 billion passwords — are aggregates of many older breaches.

What to do when you learn you are in one:

1. Find out which breach. Have I Been Pwned lists known breaches by email, and tells you which fields were exposed.
2. Change the password on that service immediately. Make it unique — do not reuse anywhere.
3. Change it anywhere else you reused it. This is where attackers actually win. A breach of a forum from 2014 turns into a bank takeover in 2026 because the same password was used.
4. Turn on two-factor authentication on the breached service and on any high-value accounts (email, bank, password manager).
5. Treat related messages as suspect for months. Attackers buy these datasets and use the real personal info inside to send convincing phishing. A message that knows your name, employer and recent purchase is more persuasive than one that does not.
6. If financial or ID data leaked, monitor your bank statements, alert your bank, and in some countries freeze your credit (the US offers this freely; in France a similar mechanism exists for fraud-victim notation at the Banque de France).
7. In the EU, you can report the incident to your national data-protection authority (CNIL in France) — under GDPR, the company is required to notify you within 72 hours of becoming aware, and you have a right to compensation for documented harm.

The single biggest practical lesson from twenty years of breaches: password reuse is the multiplier. The breach itself is rarely catastrophic by itself; reusing the same password is what turns one leak into many takeovers. A password manager is the structural fix.