Billions of records leak every year — emails, passwords, phone numbers, even ID documents. If you're online, your data has probably been breached at least once. Here's what that means and what to do.
What Is a Data Breach?
A data breach is when unauthorized people access a company's stored data. Causes include hacked servers, stolen employee credentials, misconfigured cloud storage, malicious insiders, and — most commonly — phishing attacks on staff.
How to Check If You're Affected
- Have I Been Pwned (haveibeenpwned.com) — enter your email to see known breaches involving it. Free and reputable.
- Google Password Checkup — Chrome can warn you if saved passwords appeared in breaches.
- Apple — iCloud Keychain alerts you about compromised passwords on iPhone/Mac.
Immediate Steps After a Breach
1. Change the breached password — everywhere you reused it
This is the critical one. Attackers automate "credential stuffing": trying leaked email+password pairs on hundreds of sites.
2. Enable 2FA on important accounts
Even a fresh password is safer behind a second factor.
3. Watch for phishing
Breach victims get targeted phishing using the leaked details ("We have your data, pay up"). Expect it; don't engage.
4. Check financial statements
If payment data leaked, monitor bank and card activity, and consider new card numbers.
5. Freeze your credit (where available)
Stops criminals opening accounts in your name — the most damaging long-term consequence.
6. Be ready for identity theft signs
Unexpected bills, login alerts, tax notices you didn't file — act fast on any of them.
What Companies Should Do (And Often Don't)
Encrypt stored data, limit who can access it, patch promptly, monitor for intrusions, and notify users quickly. Regulations like GDPR fine companies that fail at this — which is why breach notifications exist.
Prevention: Shrink Your Blast Radius
You can't stop companies getting breached, but you can limit the damage:
- Unique passwords everywhere (password manager) — one breach can’t cascade.
- 2FA everywhere — leaked passwords alone become useless.
- Share less — every form you fill is a future breach record.
- Delete old accounts — unused accounts are forgotten attack surface.
The Bottom Line
Assume breach, prepare accordingly. Unique passwords + 2FA turn a company data breach from a personal disaster into a minor inconvenience.
About the Author
