Glossary
Data breach
A data breach is an incident in which data is copied or exposed without permission — for example when a company's customer database is stolen.
What it means
A data breach is an incident in which data is copied or exposed without permission — for example when a company's customer database is stolen. The data can include names, email addresses, passwords, payment details or health records. The harm often arrives months later: criminals use the stolen details to send convincing phishing messages, to try the stolen passwords on other services, or to open accounts in a victim's name.
How it works
Breaches happen through unpatched vulnerabilities, stolen credentials, phishing aimed at employees, or misconfigured systems left exposed to the internet. Once stolen, data is traded on criminal marketplaces, combined with data from other breaches, and reused in credential-stuffing attacks — automated attempts to log into other services with the stolen passwords. Breach checking itself uses a technique called k-anonymity: your browser hashes what you check, sends only the first few characters of the hash to the checking service, and compares the rest locally, so the service never sees the full value. This site explains breach checking with mock screens only — it never accepts a real email address, because a live checker would need a paid data source and would create a privacy risk of its own.
Example
Imagine a fictional online shop, BrightLane, which is breached in January. The attackers copy its customer database, including email addresses and hashed passwords, and quietly leave. In April, customers begin receiving phishing emails that use their real names and order details — the stolen data made the messages convincing. The customers who had reused their BrightLane password on their email accounts find those accounts logged into from another country, because criminals had tried the stolen passwords everywhere. The breach was one event; the harm was a chain.
Common misunderstandings
The most common misunderstanding is the headline figure. A famous 2025 claim about billions of credentials was widely misread as a single new breach; in fact it was mostly a compilation of older data. The number of credentials in a compilation tells you almost nothing about how many people are newly affected. What matters after a breach is not the headline count but the action: change the password, starting with your email, and turn on two-factor authentication.
Related terms
Learn more
- What is a data breach?
- How to check if your password was leaked safely
- What is identity theft?
- Password and Account Security
- Back to the full glossary
Last checked: 14 November 2026.
Frequently asked questions
What should I do first after a data breach?
Fix your email account first, because access to your email lets an attacker reset almost everything else. Change its password to a long, unique one, turn on two-factor authentication, then work through banking and payment accounts, then everything else.
Is it safe to type my password into a breach checker?
Only into a checker that uses k-anonymity — where your browser hashes the password and sends only the first few characters of the hash, so the service never sees it. Never type your real password into a random website that promises to check it.
Does a breach mean my password was stolen?
Not always. A breach may expose names and email addresses but not passwords — or passwords that were hashed, which is much harder to use. The company's breach notice should say what was exposed; if it says passwords were included, change that password everywhere you reused it.