What Is a Data Breach? How They Happen and How to Check

Most people meet the phrase in a letter that arrives four months late, or in a headline with a number in it, and neither one explains what happened. A data breach is a specific thing with a specific definition, and knowing where its edges are is what tells you whether the letter on your kitchen table is serious, whether the number in the headline means anything, and what you are supposed to do next.

What Is a Data Breach?

Three words carry the whole definition: unauthorized, access, protected. Someone who was not permitted to see the information saw it, and the information was of a kind that was supposed to be restricted. If all three are true, it is a breach, whether the attacker was a criminal group in another country, a contractor who looked at records they had no business in, or an employee who emailed a spreadsheet to the wrong address.

What the definition does not require is harm. A breach is complete at the moment of access. Nobody has to lose money, no identity has to be stolen, and the data does not have to appear for sale anywhere. That is why an organization can tell you your data was breached and, in the same letter, say it has no evidence of misuse. Both statements are usually true, and the second one is not a retraction of the first.

It also helps to know what a breach is not. A security incident is any event that threatens the confidentiality, integrity or availability of a system, and most incidents are not breaches. A blocked intrusion attempt is an incident. A ransomware infection that encrypts files but takes nothing is an incident, and for years that was the normal shape of one. A denial of service attack that knocks a site offline is an incident. None of them involve anyone reading data they should not have, so none of them is a breach. That distinction is why counting incidents and counting breaches produce such different numbers, and it is worth holding on to when reading about the year's threats.

The last thing worth setting down is scale. A breach can be one record or fifty million. The mechanism is often identical, and the difference is only what the attacker found once they were inside.

How Do Data Breaches Happen?

A breach is a sequence, not an event, and almost every one follows the same six moves. Reading them in order explains something that otherwise seems inexplicable: why you find out months after the fact.

Step one is where the argument about causes really lives, and it moved this year. The 2026 Verizon Data Breach Investigations Report found vulnerability exploitation behind 31 percent of breaches, making it the number one entry point for the first time in nineteen years and displacing stolen credentials from that position. The reason given is speed: the report credits AI with accelerating the exploitation of known flaws, shrinking the window for defense from months to hours, which turns a routine patching backlog into an open door.

Steps two through four are the part nobody outside security thinks about, and they are the reason a breach is rarely a smash and grab. An attacker who gets in with one ordinary account cannot see much. The work is turning that account into a privileged one, then finding where the interesting data actually sits, which in a large organization can take weeks. Then the copying, which usually goes out over the same encrypted web traffic every other application uses, because that is the traffic nobody blocks.

Step five is why the timeline stretches. If nobody is reading the logs, the discovery comes from outside: an extortion email, a customer noticing fraud, a researcher finding an exposed server, or a criminal forum listing the data for sale. Step six is legally driven rather than voluntary, which is why breach notices read the way they do.

What Are the Four Common Causes of Data Breaches?

The "four causes" framing is a convention rather than a law of nature, and different sources draw the lines differently. Five buckets cover the ground honestly, and the useful thing about them is that each one has a different fix.

Two of those deserve more than a table row. Social engineering is the one that makes technical defenses irrelevant, because a phishing email or a convincing phone call to a help desk does not break anything. It borrows a real person's authority and asks for a small thing. That is how two of the breaches we have written up this year began.

The third-party row has grown fastest. The same Verizon report found breaches involving a third party at 48 percent of the total, a 60 percent jump in a single year, which means roughly half of all breaches now involve a supplier somewhere in the chain rather than only the organization whose name ends up in the headline. Your data can be taken from a company you have never heard of, because the company you did business with sent it there.

Ransomware sits across several of these rows rather than in one, because it is what happens after access rather than a way of getting it. What changed is that ransomware crews now steal the data before encrypting anything, so an incident that would once have been a costly outage is now also a breach. IBM's 2026 Cost of a Data Breach study recorded ransomware in 39 percent of breached organizations, up from 34 percent the year before.

What Data Gets Exposed in a Data Breach?

Breach notices list data classes in a flat sequence, as if a phone number and a Social Security number were comparable. They are not. What matters is what each class enables, and how long it stays useful.

• Email addresses and names. The lowest severity on their own and the most common exposure by far. Their value is as raw material: an attacker who knows you are a customer of a specific company can write a far more convincing message than one who does not.
• Passwords. Severity depends entirely on how they were stored. Properly hashed with a modern algorithm, they are close to useless. Stored in plain text or with an obsolete hash, they are live. Either way the real risk is reuse, because credential stuffing takes a list from one breach and tries it against every other service automatically.
• Payment card numbers. High severity, short life. Cards get reissued, federal law caps what you can be held responsible for on unauthorized credit card charges at $50, and the window closes quickly.
• Social Security numbers. High severity, permanent. You cannot reissue one in any practical sense, which is why an SSN exposure is the case where freezing credit is the correct response rather than an optional one.
• Health information. High severity and permanent, and it carries a second problem: it cannot be changed, it is unusually effective in targeted fraud, and its exposure is regulated separately under HIPAA.
• Government identifiers and account credentials for financial services. The combination is what makes account takeover possible rather than merely plausible.

The severity of a breach is a function of the combination, not the count. Fifty million email addresses is a smaller problem than fifty thousand records pairing a name, a date of birth and a Social Security number, because the second set is enough to open an account in someone else's name and the first set is not.

How Do I Check If My Personal Data Has Been Breached?

There is no single register, which is the honest answer and the reason this question keeps getting asked. There are four places that hold most of the answer, and checking all four takes about fifteen minutes.

Have I Been Pwned. The closest thing to a central index. It is a free service that collects breached data sets, verifies them, and lets you search for your own email address across all of them. As of this writing it holds 17,805,159,840 pwned addresses across 1,034 pwned websites, and its answer tells you which breach your address turned up in and what was exposed alongside it. Search every address you use, including the old one from fifteen years ago, and turn on its notification service so the next one reaches you before the letter does.

Your state attorney general's breach list. Every state has a notification law, and many require organizations to file a copy of the notice with the attorney general, who publishes it. California's is the most used because the state's threshold is low and its economy is large: a sample copy of any breach notice sent to more than 500 California residents must be provided to the California Attorney General, and the resulting list is searchable by organization name. If you want to know whether a specific company had a breach, this is where the primary document lives, and the notice itself will say exactly which data classes were involved.

The HHS breach portal, for anything medical. Health data is handled under a separate regime. The Department of Health and Human Services Office for Civil Rights investigates all breaches of protected health information affecting 500 or more individuals, and the reported incidents are published in a searchable portal covering hospitals, insurers, dental plans and their business associates. If a provider you use has reported a breach at that size, it is listed there.

Your credit report. The other three tell you what was taken. This one tells you whether anything has been done with it. You are entitled to a free report from each of the three bureaus, and all three currently let you check weekly at AnnualCreditReport.com. The thing to look for is an account or an inquiry you do not recognize. If you find one, or if a Social Security number was in the exposure, freeze your credit rather than waiting to see what happens next.

What Are Examples of Data Breaches?

The examples most articles reach for are a decade old, which makes them useless for seeing what a breach looks like now. Two from this year show the two shapes a reader is most likely to meet.

Eight months is not unusual and it is the practical argument for checking rather than waiting. Across the seven incidents in every report we publish, the pattern largely repeats: one extortion group, ShinyHunters, is named in six of the seven, the data is published rather than quietly sold, and the record count that ends up being reliable is the one a breach database verifies afterward.

The historical examples are still worth knowing for scale. Yahoo told the SEC in 2017 that a single 2013 theft had affected all of its roughly three billion accounts. Equifax in 2017 is the one that changed United States policy: the FTC put that breach at approximately 147 million people and 145.5 million Social Security numbers, and the following year credit freezes became free nationwide under a new federal law. Both are useful as reference points and neither tells you much about how a breach happens today.

Data Breach vs Data Leak

The two words get used interchangeably and they describe different events. The difference is whether anybody had to do anything.

Two related words are worth pinning down while we are here. A data spill or exposure is the same thing as a leak. Exfiltration is the specific act of copying data out, which is step four of the sequence above and the thing that separates a breach from an intrusion that took nothing.

What to Do If Your Data Was Breached

The short version is five moves, in order: change the password on the breached account and anywhere you reused it, turn on multi-factor authentication there, watch for the phishing wave that follows a breach against exactly the people it exposed, pull your credit reports, and freeze your credit if a Social Security number was involved.

That is the summary. The full sequence, including how to tell a real notice from a fake one, what the different data classes each require, whether identity theft protection is worth paying for, and how long the exposure keeps mattering, is set out in what to do after a data breach, which is the page to work through with a notice in front of you.

How Much Does a Data Breach Cost?

The figure everyone quotes comes from one study, and it is worth knowing what it measures before repeating it.

What that number includes is detection and escalation, notification, the response effort, and lost business, which is usually the largest single component and the hardest to measure. What it does not include is anything that happens to the affected people, who bear the fraud risk, the time spent on freezes and disputes, and the permanent exposure of data that cannot be reissued.

The average also hides an enormous spread. It is an average across organizations large enough to participate in a study of this kind, and a breach at a thirty-person company does not cost five million dollars. For a small business the realistic costs are forensic investigation, legal advice on notification obligations, the notification itself, credit monitoring for the affected people, and whatever the customers do afterward. The last one is the one that closes companies.

How to Prevent a Data Breach

Prevention advice usually arrives as an unordered list, which is unhelpful because the items are not equal. Ordered against the causes in the table above, the first two do most of the work.