Security Data breaches and identity theft
What a data breach is and what it means for you
What actually leaks in a breach, why hashed passwords are not all equal, how the data gets used months later, and what you should do when the notification email arrives.
The short answer
- A data breach matters only in terms of specific fields: which ones leaked, how the passwords were stored, and whether you can change what was taken.
- Hashed is not one thing, because old fast hashes fall to billions of guesses per second while slow password hashes such as bcrypt and Argon2 make bulk cracking impractical.
- Leaked credentials get merged into combo lists and replayed automatically against other sites, so reuse is what turns one company's breach into yours.
- Misuse typically arrives months later, because detection is slow, notification is slower, and identity data has no expiry date.
- Passwords and cards are fixable in a day, but a date of birth or a national ID number is permanent, so the response shifts to detection.
- Never act on a breach notification through a link in the email, because fake reset pages follow every announced breach within days.
A data breach is an incident where information a company held about you ends up somewhere it was never meant to go. The word itself tells you almost nothing. What matters is which fields left the building, because an email address alone is an annoyance, while an email address plus a password hash plus your date of birth plus the last four digits of a card is a working kit for impersonating you. So the useful questions are narrow: which fields, how were the passwords stored, and can you change what leaked?
What actually leaves in a breach
Companies keep your data in separate tables, and attackers take whichever ones they reach. That is why two breaches at similar companies can have completely different consequences. Four categories cover most of it.
- Credentials: usernames, password hashes or occasionally plaintext passwords, security answers and session cookies. This is what gets your other accounts taken over.
- Identifiers: name, address, phone, date of birth and government numbers such as a Social Security number, a national insurance number or a passport number. Raw material for opening credit in your name and for talking a call center into resetting something.
- Financial: card numbers (usually truncated to the last four digits, sometimes not), expiry dates, bank account and routing or sort codes, transaction histories. A full number with an expiry is spendable wherever the security code goes unchecked.
- Behavioral: order history, IP addresses, device identifiers, location, support tickets, message contents. Rarely direct fraud, but it is what makes a later scam message convincing, because the sender can quote what you bought and when.
The line that matters most is not sensitivity. It is whether you can change the field.
| Leaked field | What it enables | Can you change it? |
|---|---|---|
| Password | Account takeover on that site and anywhere you reused it | Yes, in minutes |
| Card number | Card not present fraud until the card is reissued | Yes, in a few days |
| Phone number | Scam texts, SIM swap attempts, account recovery abuse | Painfully, and it breaks your logins |
| Date of birth | Identity checks over the phone, new credit applications | Never |
| National ID number | New accounts, tax and benefits fraud, medical fraud | Effectively never |
Read that last column before you panic or relax. A leak of passwords and cards is loud but fixable in an afternoon. A leak of name, address, date of birth and a national ID number is quiet and permanent.
Hashed does not mean safe
Almost every breach notice says passwords were hashed, and many say hashed and salted, as though that settles it. It does not, because the word covers methods that differ in strength by a factor of millions.
Hashing runs your password through a one way function. The site stores the output, so it can check a login without holding the password. An attacker who steals the file cannot reverse the hashes, so they guess: hash a candidate, compare, repeat. Everything depends on how fast that loop runs. Old fast hashes such as MD5 and SHA-1 were built for speed, and ordinary graphics hardware runs them at billions of guesses per second. Methods built for passwords, such as bcrypt, scrypt and Argon2, make one guess cost real time and memory, dropping the rate to thousands per second. The same file is a weekend project or a lost cause depending on which the company chose.
Salting is separate. A salt is a random value stored with each password so two users with the same password get different hashes. It kills precomputed lookup tables, but it does nothing to slow guessing against one chosen account. Salted plus fast is still weak.
Two more phrases matter. Encrypted passwords are reversible with a key, and the key is sometimes stolen in the same intrusion. Plaintext shows up more often than you would expect, usually in debug logs or old backups. Against all of them, one defense is yours: a password long and random enough to sit outside every wordlist, which is what length rather than symbols buys you.
How a breach becomes a combo list
Stolen data moves down a chain, and the price falls at each step, which is why a database that cost real money on day one circulates free two years later.
It starts private: the intruder sells to a few buyers or extorts the company. Buyers work the fresh data for whatever pays fastest, then resell more widely. Eventually the cracked credentials are stripped to bare email and password pairs and merged with hundreds of other sources into a combo list, a plain text file with no record of which site any line came from.
Combo lists feed credential stuffing. Tools replay each pair against hundreds of sites, routed through residential proxies so the attempts look like home users. Nothing is cracked at this stage. The tool is trying a key that already works somewhere, which is why reusing one password across sites turns one company's mistake into a problem across your whole account list.
One major source is not a company breach at all. Infostealer malware on one computer harvests saved browser passwords and live session cookies, and those logs sell in the same markets. If your details surface and no company you use has announced anything, that is the likely explanation, and the device needs cleaning before new passwords are worth setting. Checking whether your password has leaked covers doing that safely.
Why the damage shows up months later
People watch their bank for a week, see nothing, and conclude they got lucky. The timeline does not work that way, for three reasons.
First, detection and notification are both slow. Intrusions are often found long after they start, and the letter goes out only once forensics establishes what was taken.
Second, data is worked in order of perishability. Card numbers and live sessions get used at once because they expire. Identity data has no expiry, so it waits until the buyer has capacity or the season suits. Tax fraud clusters around filing season, and credit applications get spread out so they do not trip one alert together.
Third, records get combined. A phone number from one breach plus a date of birth from another plus an employer from a third produces a profile good enough to pass a phone verification, and none of those breaches looked serious alone. That aggregation is what makes someone opening an account in your name possible from scraps.
How to read a notification honestly
Breach letters are written by lawyers and are technically accurate. The skill is knowing what the stock phrases do and do not claim.
| What it says | What it actually means |
|---|---|
| No evidence of misuse | They have no visibility into what buyers do with it. Absence of evidence, not evidence of absence |
| Passwords were encrypted | Ask whether they mean hashed. Encryption is reversible if the key was taken too |
| A limited number of customers | The number confirmed so far. Revised counts almost always go up |
| No financial information was affected | Cards are safe. Says nothing about identity data, which is often worse |
| Out of an abundance of caution | Standard legal phrasing, present in nearly every letter, carries no information |
A good letter names the date range and the exact fields. If yours will not, assume the worst category it does not explicitly rule out.
The rules behind the letter differ by region, and this is general information rather than advice for your situation. In the United States, breach notification is set by state law, so triggers and timing vary by where you live, with extra rules for health and financial data. In the EU and the UK, the GDPR gives the company 72 hours to tell the regulator once it knows, and requires it to tell affected people without undue delay where the risk is high. Both also let you ask what a company holds about you, covered in your data rights.
One more point: a breach announcement is prime bait. Scammers send their own version, linking to a convincing reset page, within days of the real news. Never act through a link in a breach email. Type the address yourself or use the app, the discipline described in how phishing messages get past careful people.
What to do when the email arrives
Order it by what is reversible and how fast the window closes.
- Change the password on the breached account, then on every account using that password or a variation of it. Start with email, because it resets everything else.
- Turn on two-factor authentication on email, banking and anything holding a saved card.
- If a full card number leaked, ask for a reissue rather than watching the statement.
- If identity fields leaked, switch to detection: lock your credit file where that is available, and review recovery options, because your phone number and date of birth are now answers someone else knows.
- Expect phishing quoting real details from the breached company, and treat anything referencing it as hostile.
The full version, broken down by exposed field and covering credit freezes, monitoring offers and SIM protection, is in the breach response checklist.
The part you cannot undo
Be honest about the ceiling. You cannot retract data, you cannot get a new date of birth, and no service can delete your record from files already copied across thousands of machines. Once identifiers are out, the job is detection, not prevention.
So the work worth doing is structural: unique passwords so one breach stays contained, a second factor on the accounts that control the others, a locked credit file so a new application cannot be approved quietly, and enough familiarity with the warning signs to notice trouble in weeks rather than a year. Do those four and the next notification is paperwork.
Common questions
How do I know if a breach notification email is real?
Do not judge it by the letter. Open a browser, type the company address yourself or use its app, and look for the same announcement in your account or its newsroom. Real breach notices are always reachable that way. Scam versions rely entirely on you clicking their link, and they appear within days of any breach that makes the news.
My password was hashed, do I still need to change it?
Yes. You have no way to verify which hashing method was used, whether the salt was stored badly, or whether some accounts were in an older format. Changing a password costs a minute. The one case where it is genuinely low risk is a long random password from a manager, which stays outside cracking wordlists regardless of algorithm, but changing it is still the cheaper call.
Can I get my data removed from a breach?
No. Once a database has been copied and resold, there is no mechanism to recall it, and services that promise removal from breach dumps cannot deliver. You can ask the company to delete what it still holds, and you can ask data brokers to remove profiles they built. Neither touches the copies already circulating.
Why do I keep getting spam after a breach that only leaked email addresses?
Because an address that appeared in a specific company's breach is worth more than a random one. The sender knows you had an account there, often knows roughly when, and can write a message that matches. That context is exactly what makes the message convincing, which is why even a low severity breach changes the quality of what lands in your inbox.
Should I use a different email address for every account?
A separate address for shopping and signups is worth doing and takes minutes. A unique alias per service is better still, since it tells you which company leaked and lets you shut off that address alone. Many mail providers and password managers generate aliases automatically. Unique passwords remain more important than unique addresses if you only do one.