What is a data breach?
A data breach is any time information held by a company gets accessed or taken without permission — and ends up somewhere it shouldn't.
When you sign up for a service, you hand over data: your email, a password, sometimes your phone number, address, or payment details. The company stores it. A data breach happens when attackers get into that store — or the company accidentally exposes it — and that information escapes.
Once it's out, it rarely stays in one place. Leaked data gets copied, traded, and bundled into larger collections that circulate on forums and the dark webDark web. Parts of the internet that aren't indexed by normal search engines and need special software to reach — where stolen data is often traded.. That's why a breach from years ago can still affect you today.
How does data get leaked?
Breaches usually trace back to a handful of causes:
- Hacked databases — attackers exploit a weakness in a company's systems and copy entire user tables.
- Stolen credentials — an employee's login is phished, giving attackers a way in.
- Misconfigured storage — a database is left open to the internet with no password by mistake.
- Credential stuffingCredential stuffing. Attackers take email-and-password pairs from one breach and automatically try them on hundreds of other sites, betting on password reuse. collections — leaked logins from many breaches get merged into giant searchable lists.
- InfostealerInfostealer. Malware that silently lifts saved passwords and autofill data from an infected device. malware — software on an infected device quietly harvests saved passwords.
What kind of data gets exposed?
Not all breaches carry the same risk. What was taken determines how much danger you're actually in:
- Email addresses — the most common. On their own they're low-risk, but they're the starting point for targeted phishing.
- Passwords — the most dangerous, especially if you reused them. Even "hashed" passwords can be cracked over time.
- Phone numbers — used for SIM-swap attacks and smishing (text-message phishing).
- Financial data — card numbers and bank details enable direct fraud.
- Identity data — dates of birth, addresses, and government IDs are the building blocks of identity theft.
When you check your email, each result spells out which of these was exposed, so you know how urgently to act. To understand how leaked logins get weaponized, see what credential stuffing is.
How to tell if you're affected
You usually won't get a personal warning. The fastest way to know is to check your email against known breach datasets.
Check your email free
See which breaches include your address — in 2 seconds, no signup.
A result tells you which breaches your email appears in and what data was exposed. If a password was involved, that's the most urgent kind — because of reuse.
Why a breach is dangerous
The danger isn't the breach itself — it's what attackers do with the data afterward:
- Account takeover — if a leaked password still works somewhere, they're in.
- Phishing — leaked details make fake emails far more convincing.
- Identity theft — enough personal data lets someone impersonate you.
The single biggest risk multiplier is password reuse. One leaked password becomes a master key to every account where you used it.
How long does breach data stay dangerous?
Indefinitely. Unlike a stolen credit card you can cancel, leaked personal data can't be recalled. Once an email-and-password pair lands in a breach collection, it gets copied across forums and resold for years.
That's why breaches from 2012 still cause account takeovers today — and why "I changed that password ages ago" isn't always enough. If you reused it anywhere, those other accounts stay exposed until you change them too. The dataset behind this checker alone spans 12 billion-plus exposed records across nearly a thousand known breaches (as of 2026), and it grows every week. For a deeper look, see what actually happens to stolen data.
What to do if you're breached
Work through these in order — the first two matter most:
- Change the breached password, and every account where you reused it.
- Turn on two-factor authentication on email, banking, and anything with payments.
- Switch to a password manager so every account gets its own strong password.
- Watch your accounts for unusual activity for at least 30 days.
- Check your passwords directly — even unbreached accounts are at risk if the password is public.
How to protect yourself going forward
You can't stop companies from getting breached — but you can make a breach harmless to you:
- Unique password per account — the single most effective habit.
- 2FA everywhere it's offered — neutralizes a stolen password.
- A password manager — makes both of the above effortless.
- Periodic checks — new breaches surface constantly; recheck now and then.
Notable breaches you may have been part of
Some breaches were so large that a big share of internet users were caught in them. If you've had an account for a few years, you've probably been in at least one:
Browse the full breach directory to see the biggest known incidents and exactly what each one exposed.