A data breach occurs when information held by an organization — a company, government agency, or other institution — is accessed or disclosed without authorization. That can mean an external attacker breaking in, an insider misusing access, or, in some cases, data being accidentally exposed through a misconfigured system rather than a deliberate attack at all.
How Breaches Typically Happen
- Exploited software vulnerabilities in a company's systems, particularly unpatched, known flaws
- Phishing attacks against employees that grant an attacker access using legitimate, stolen credentials
- Weak or reused passwords on administrative or database systems
- Misconfigured cloud storage left publicly accessible without an intentional attack at all
- Third-party vendor compromise, where an attacker breaches a smaller partner or contractor that has access to a larger company's systems or data
What Kind of Data Is Usually Exposed
The specifics vary enormously by breach, but commonly exposed categories include email addresses and passwords (sometimes stored securely as hashed values, sometimes not), names and physical addresses, phone numbers, partial or full payment card information, and in more serious cases, Social Security numbers or other government identifiers. The breach notification you receive should specify which categories of your data were involved — it's worth reading that section carefully rather than skimming past it, since your response should differ depending on what was actually exposed.
Why "Was My Password Hashed?" Matters
A technical distinction worth understanding
Responsible companies store passwords as "hashed" values — a one-way cryptographic transformation that can verify a password without storing the original text. If a breach notification mentions passwords were stored "hashed and salted," recovering the original password from the stolen data is significantly harder for an attacker, though not always impossible depending on the hashing method used. If a company discloses that passwords were stored in plain text, that's a more serious situation and warrants an immediate password change.
Step-by-Step: What to Do If You're Notified
- Read the notification carefully to identify exactly which categories of your data were involved — this determines the rest of your response.
- Change the password for the affected account immediately, and change it on any other account where you reused the same password.
- Enable multi-factor authentication on the affected account and, ideally, on your other important accounts if you haven't already.
- If financial account details were exposed, contact your bank or card issuer to discuss reissuing your card and monitor upcoming statements closely.
- If a Social Security number or similarly sensitive identifier was exposed, consider placing a free credit freeze with the major credit bureaus, which blocks most new credit accounts from being opened in your name.
- Watch for follow-up phishing attempts. Attackers frequently use breached data (like knowing your name and that you use a specific service) to craft more convincing follow-up phishing emails referencing the breach itself.
- Check whether your email has appeared in other breaches using a free breach-notification tool, since one exposure often prompts people to discover they've been affected by others they didn't know about.
Should You Accept the Free Credit Monitoring Companies Sometimes Offer?
Companies affected by a breach often offer a free period of credit monitoring as part of their response. It's generally reasonable to accept this at no cost, though it's worth remembering it typically only covers a limited time window and specific monitoring, not comprehensive protection — the steps above (password changes, MFA, credit freezes where appropriate) matter regardless of whether you accept an offered monitoring service.
A Reasonable Long-Term Habit
Rather than reacting only when notified directly, periodically checking a free breach-notification tool for your email addresses is a low-effort way to catch exposures that a company may not have proactively notified you about, particularly for smaller or less-publicized breaches.
Frequently Asked Questions
How do I know if my information was part of a data breach?
Companies are generally required to notify affected individuals directly in most jurisdictions, but you can also proactively check using free breach-notification tools that let you search whether your email address has appeared in known breaches.
Should I change my password if a breach didn't include passwords?
If the notification specifically states passwords weren't involved, changing that particular password isn't strictly necessary for that incident, but it's still worth confirming you're not reusing that same password on other accounts where it could matter.
Does a data breach notification mean I'm definitely a victim of identity theft?
No. A breach notification means your data was exposed and could potentially be misused, not that misuse has definitely occurred. The response steps above are about reducing that risk and catching misuse early, not necessarily undoing something that's already happened.