What Is a Data Breach? Causes, Consequences & What to Do

Billions of records are stolen in data breaches every year. Your personal information — email, password, home address, credit card number, or Social Security number — may already be in the hands of criminals without you knowing. This guide explains what data breaches are, how they happen, and exactly what to do if you're affected.

What is a data breach?

A data breach is an incident where unauthorized individuals access, steal, or expose confidential information. This can mean a hacker breaking into a company's servers, an employee leaking data intentionally, or a company accidentally exposing data publicly through a misconfigured database.

The data stolen in a breach can include:

How data breaches happen

1. SQL injection attacks

SQL injection is one of the oldest and most common attack vectors. If a web application doesn't properly sanitize user input, an attacker can insert malicious database commands through login forms, search boxes, or URL parameters, extracting the entire database in a single attack.

2. Credential stuffing

Attackers use stolen email/password pairs from previous breaches to attempt logins on other services. Because 65% of people reuse passwords, credential stuffing succeeds at scale — a 0.1% success rate against 100 million credential pairs yields 100,000 compromised accounts.

3. Phishing attacks

Employees are tricked into revealing credentials or clicking malicious links. Once an attacker has an employee's credentials — particularly for a privileged account — they can access internal systems, databases, and files. Many of the largest breaches began with a single phishing email.

4. Misconfigured cloud storage

Companies store data in cloud services (AWS S3, Azure Blob, Google Cloud Storage) and accidentally leave buckets or containers publicly accessible. Billions of records have been exposed this way with no active attack required — anyone who knew the URL could access them.

5. Insider threats

Current or former employees with legitimate access to data leak it intentionally (for financial gain, revenge, or espionage) or accidentally (by sending data to the wrong recipient, leaving a laptop unattended, or misconfiguring permissions).

6. Third-party and supply chain attacks

Even if a company's own security is good, their suppliers, contractors, or software vendors may have weaker security. The 2020 SolarWinds attack compromised thousands of organizations by attacking a software update mechanism, demonstrating that supply chain attacks can bypass even sophisticated defenses.

Largest data breaches in history

What happens to stolen data

1. Dark web sale — Stolen credentials are sold in bulk on dark web marketplaces within hours of a breach. Fresh breach data commands premium prices.
2. Credential stuffing — Automated tools test stolen credentials against hundreds of other services immediately.
3. Identity theft — With enough personal data (name, SSN, DOB, address), criminals can open credit accounts, file fraudulent tax returns, or apply for government benefits in your name.
4. Spear phishing — Detailed personal data enables highly targeted, convincing phishing attacks using your real name, address, or account details.
5. Spam and scams — Email addresses and phone numbers are sold to spam operations and scam callers.

How to find out if you've been breached

Use Have I Been Pwned (haveibeenpwned.com) — a free service run by security researcher Troy Hunt that indexes public breach data. Our Breach Checker queries the same database using k-anonymity, so your full email address is never transmitted.

You can also sign up for breach alerts — HIBP will email you if your address appears in a new breach.

What to do immediately if you're breached

Frequently asked questions