Learn Dark Web

Cybersecurity

What Is a Data Breach? Explained

A data breach is an incident in which private information — names, passwords, payment details, health records — is accessed, stolen or exposed without authorisation. Breaches are reported constantly, and almost everyone's details have appeared in one. This guide explains how breaches happen, what the risks really are, and the practical steps to take after one.

By Abdul Hannan · Published 14 November 2026 · Updated 14 November 2026

Try the tool: Data Breach Explainer

Note. A breach does not mean your data was used — it means it was exposed. The risk depends on what was taken. Passwords and payment details need action within hours; names and email addresses mainly need vigilance. Match your response to the data, not to the headline.

What a data breach is

A data breach is any incident in which information that should have stayed private is accessed or disclosed without authorisation. It can be caused by a criminal attack — hacking, phishing, ransomware — or by a mistake: a database left exposed on the internet, an email sent to the wrong person, a laptop left on a train. The cause matters for prevention, but for the people whose data is involved, the first question is always what was taken.

Breaches differ enormously in scale and severity. A breach of a small shop's mailing list is a different event from a breach of a health insurer with tens of millions of records. News reports often quote the total number of records, but one record can contain many pieces of information — and the same person's details often appear in many breaches at once, because data is stolen, traded and combined.

One figure deserves a warning: large numbers reported in the press are often misread. Reports of billions of credentials usually count records across many old breaches combined, not a single new event, and a single person's details may be counted several times. When you read a breach headline, look for what was actually taken and from whom, not just the size of the number.

How breaches happen

The most common causes are criminal and mundane in roughly equal measure. On the criminal side: phishing emails that capture an employee's password, exploitation of an unpatched system, stolen credentials bought from an earlier breach and reused, and ransomware attacks that copy data out before encrypting it. On the mundane side: a cloud storage bucket left public, a database with a weak password, a contractor with too much access, or a device that is lost or stolen.

A frequent pattern is the credential stuffing attack: criminals take usernames and passwords stolen from one breach and try them automatically against many other services. It works because people reuse passwords. That is why one breach can compromise accounts that had nothing to do with the original incident — and why unique passwords matter so much.

Insiders cause breaches too, though less often: an employee with access to more data than their job requires, or a departing employee who takes a customer list. Access control — giving people only the data they need — is the defence, and it is one organisations often get wrong.

What data gets taken, and why the type matters

Names and email addresses are the most commonly stolen data. On their own they are low-risk, but they enable phishing: an attacker who knows your name, your employer and your email address can write a convincing message addressed to you. Expect more phishing after a breach that exposed your email address, and treat unexpected messages with extra suspicion.

Passwords are more serious, especially if they were stored without proper protection. A stolen password that you reuse elsewhere puts every account with that password at risk — change them all, starting with your email. Payment card details can be cancelled and replaced, which is inconvenient but manageable. Identity documents, national ID numbers and health records are the hardest to fix: you cannot change your date of birth or your health history, so a breach involving those needs long-term vigilance and, where available, a fraud alert or credit freeze.

Location data, messages and photos are the most personal. A breach involving those is not only a security problem but a privacy one, and if it affects you, the organisation that lost the data should tell you exactly what was taken and what to do — that notification is a legal duty in many countries.

How breach checking works: k-anonymity in plain English

You may have heard of services that tell you whether your email or password appeared in a breach. A safe password check works in a way that never sends your full password anywhere. It uses a technique called k-anonymity. Here is the idea: your password is turned into a one-way fingerprint — a hash — on your own device. Only the first few characters of that fingerprint are sent to the service, never the password itself.

The service replies with a list of all fingerprints that start with those same few characters — hundreds of them — and your device checks privately whether your full fingerprint is among them. Because the service only ever sees a short prefix that matches hundreds of passwords, it cannot tell which password you were checking. Your full password never leaves your device, and your full fingerprint is never sent either.

That is the safe way to check, and it is the way a password leak checker should be built: local checking, with only a short hash prefix exchanged. Never type your password into a site that asks for the full password, and never use a service that asks for your full email address combined with a password. This site does not run a live breach checker — checking a password against breach data would need an outside service, and we do not send anything you type to one. Judge any third-party checker by the method above: local hashing, short hash prefix only, no account, and never email-plus-password together.

What to do after a data breach

First, read the notification carefully: what was taken, from whom, and what the organisation advises. Then act in order of risk. If passwords were involved, change the affected password immediately — and change the same password everywhere else you reused it. Turn on two-factor authentication on the affected account and on your email account.

If payment details were involved, contact your bank or card provider and ask them to watch the account or replace the card. Check your statements for the next few weeks, including small transactions, which criminals sometimes use to test a card. If identity documents were involved, consider a fraud alert or a credit freeze with the credit reference agencies in your country, and keep the reference numbers.

Then protect the future: use a password manager so every account has a unique password, turn on two-factor authentication on email, banking and social media, and set up transaction alerts with your bank. A breach is also a good moment to close accounts you no longer use — every old account holding your data is another breach waiting to happen.

  • Change the affected password, and everywhere you reused it.
  • Turn on two-factor authentication on email and banking first.
  • Contact your bank if payment details were involved.
  • Consider a fraud alert or credit freeze for identity documents.
  • Close old accounts you no longer use.

How organisations should respond

An organisation that suffers a breach has duties, and they are set by law in most countries. In the European Union and the United Kingdom, the GDPR requires breaches involving personal data to be reported to the regulator within 72 hours where there is a risk to people, and the affected people must be told without undue delay where the risk is high. Similar duties exist under state laws in the United States and under other national laws elsewhere.

Good breach response is honest and specific: what happened, what was taken, what is being done, and what the affected people should do. Vague statements that minimise the problem destroy trust and often precede regulatory action. Affected people should be offered practical help — password resets, monitoring, or a path to a credit freeze — not just an apology.

If you are notified of a breach and the notification is vague, ask the organisation directly what data of yours was involved. You have a right to know, and the answer decides how seriously you need to act. If the organisation will not say, your regulator can help.

Sources

Last checked: 14 November 2026.

Frequently asked questions

What is a data breach?

A data breach is an incident in which private information is accessed, stolen or exposed without authorisation. It can be caused by a criminal attack, such as hacking or phishing, or by a mistake, such as a database left exposed on the internet.

How do I know if my data was in a breach?

The organisation that lost the data should notify you. You can also check whether your email address appeared in known breaches through a reputable breach notification service — and use a password leak checker that uses k-anonymity, so your full password never leaves your device.

What should I do first after a data breach?

Change the affected password immediately, and change the same password everywhere else you reused it. Turn on two-factor authentication on your email and banking, and contact your bank if payment details were involved.

How does a k-anonymity password check work?

Your password is turned into a one-way fingerprint on your own device. Only the first few characters of that fingerprint are sent to the service, which returns all fingerprints sharing that prefix. Your device checks privately whether yours is among them — your full password never leaves your device.

Is my data still at risk years after a breach?

Stolen data is traded and combined for years, so the risk does not end when the headlines stop. The lasting protection is unique passwords, two-factor authentication, and vigilance for phishing that uses your stolen details.