What is a data breach?
Definition
A data breach is an incident where personal or other sensitive information is accessed, disclosed or taken by someone who shouldn't have it, whether through an attack or by accident.
- Category
- Data
- Also called
- personal data breach, data breaches, security breach
- Last updated
A data breach happens when information ends up where it shouldn't. NIST describes a breach as a loss of control, or unauthorized access, disclosure or acquisition, of personal information. That includes someone outside an organization getting in, and also an employee who looks at records for a reason they have no right to.
The UK's data protection regulator, the ICO, adds that a breach doesn't have to be a hack. It calls a personal data breach a security incident that affects the confidentiality, integrity or availability of personal data, accidental or deliberate. Its examples include sending data to the wrong recipient, losing a laptop or phone that holds personal data, and changing data without permission.
What a breach looks like to you
Usually you hear about it second hand: an email or letter from a company you gave your details to, saying some of them were exposed. What's in the file depends on the company. It might be just an email address and a hashed password, or it might be your full name, address, date of birth and card or Social Security number.
The FTC points out that scammers buy credentials stolen in breaches and try the same username and password on other accounts. So a breach at a site you barely remember can still lead to someone logging in to your email.
Data breach vs. data leak
People use the two words loosely. A breach usually means someone broke in or took the data. A leak is often a company's own mistake, such as a database left open without a password. For you the result is the same: your details are out of your control.
Breach data tends to be copied and traded, so it can't be pulled back. What you can do is change what it's useful for: new passwords, locked credit files and a close eye on your accounts.
How to protect yourself
- 1
Change the breached password, and any copy of it
The FTC advises changing the password with the affected company and on any other account that uses a similar one. Start with your email, because password resets for other accounts go there.
- 2
Turn on two-factor authentication
It helps protect an account even when the password is known. Use an authenticator app or security key where the site allows it.
- 3
Check what was exposed, then act on that
IdentityTheft.gov lists steps for each type of data. Card or bank numbers mean calling your bank or card issuer and watching for charges. A Social Security number means thinking about a credit freeze.
- 4
Freeze your credit and check your reports
The FTC says a credit freeze and a fraud alert are both free. A freeze means contacting each of the three bureaus. Check your reports at AnnualCreditReport.com for accounts you don't recognize.
- 5
Be careful with breach emails
Scammers send fake breach notices. Don't click links or call numbers in the message. Contact the company through a site or number you already know. If the email looks real, Serus monitors breach databases and the dark web for your email and other data and alerts you when it shows up. It can't remove data from a breach, but it tells you what to do next.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
What should I do first after a data breach?
Change your password for the affected account and any other account that uses a similar one, starting with your email. Then turn on two-factor authentication and check what type of data was exposed.
Do companies have to tell me about a breach?
Often, but the rules depend on where you live and what was exposed. In the UK, the ICO says organizations must notify it of a breach that's likely to risk people's rights and freedoms, generally within 72 hours of becoming aware. Rules for telling the people affected differ by country and US state.
Can a data breach happen without hacking?
Yes. The ICO counts accidental incidents too, such as emailing personal data to the wrong person or losing a device that holds it.
How do I know if my data was in a breach?
Companies usually notify affected people. You can also search your email address on a breach lookup service such as Have I Been Pwned.
Sources
Something wrong or out of date? Tell us and we'll re-check it.