Data Breaches Explained: How They Happen and What to Do

The Scale of the Data Breach Crisis

Data breaches have become so routine that they barely make the news anymore. In 2025 alone, there were over 3,200 publicly disclosed data breaches affecting more than 18 billion individual records, according to the Identity Theft Resource Center. That is more than two breaches for every person on Earth.

The uncomfortable reality is that your personal data — your name, email address, phone number, password, credit card details, and even your Social Security number — has very likely already been exposed in one or more breaches. The question is not “will my data be breached?” but “when was it last breached, and have I taken steps to protect myself?”

This article explains what data breaches actually are, how they happen, what famous examples have taught us, what data gets exposed, and most importantly, the exact steps you should take to protect yourself.

---

What Is a Data Breach?

A data breach occurs when an unauthorized party gains access to a database, system, or network containing sensitive information. The unauthorized party — whether a criminal hacker, a nation-state actor, or a careless insider — copies, steals, or exposes data that was supposed to be protected.

Data breaches are not always the result of sophisticated hacking. They can occur through:

• External attacks: Hacking, SQL injection, brute-force attacks, phishing
• Insider threats: Employees accessing data they should not, or accidentally exposing it
• System misconfigurations: Databases left unsecured, cloud storage exposed to the public
• Physical theft: Stolen laptops, hard drives, or backup tapes
• Supply chain attacks: Compromising a third-party vendor to access the primary target

What data is typically exposed?

The type of data exposed varies by breach, but common categories include:

Data Type	Risk Level	Potential Impact
Email addresses	Medium	Phishing, spam, account enumeration
Passwords	Critical	Account takeover, credential stuffing
Phone numbers	Medium	Smishing, vishing, SIM swapping
Full names	Low-Medium	Identity theft, social engineering
Physical addresses	Medium	Identity theft, physical theft
Credit card numbers	Critical	Financial fraud, unauthorized purchases
Social Security numbers	Critical	Full identity theft, tax fraud
Health records	Critical	Insurance fraud, discrimination
Dates of birth	Medium	Identity theft, security question answers
IP addresses	Low-Medium	Tracking, targeted attacks

---

How Data Breaches Happen

1. Credential stuffing and password reuse

This is the most common attack vector. When a database of usernames and passwords is leaked, attackers use automated tools to try those same credentials on hundreds of other websites. Because so many people reuse passwords, a breach at one site leads to compromises at many others.

A 2024 study by SpyCloud found that over 70% of breached credentials were reused on other platforms, leading to cascading compromises across multiple services.

2. SQL injection

SQL injection remains one of the most prevalent web application vulnerabilities. Attackers insert malicious SQL code into input fields (login forms, search boxes, URL parameters) to manipulate the database behind the application. This can allow them to extract entire tables of data, including user credentials.

3. Phishing and social engineering

Many breaches begin with a single employee clicking a malicious link or downloading an infected file. Spear phishing attacks targeting specific employees with access to sensitive systems have been the initial vector in some of the largest breaches in history.

4. Misconfigured databases and cloud storage

A surprisingly large number of breaches occur not because of sophisticated attacks, but because of simple misconfigurations. Unsecured Amazon S3 buckets, Elasticsearch databases without authentication, and MongoDB instances exposed to the public internet have all led to massive data exposures.

5. Supply chain attacks

When a company’s vendor or service provider is compromised, the attacker may gain access to the company’s data through that trusted connection. The 2020 SolarWinds attack demonstrated how a single supply chain compromise can affect thousands of organizations.

6. Insider threats

Not all breaches are external. Disgruntled employees, careless contractors, or negligent staff can expose data through intentional theft, accidental sharing, or failure to follow security protocols.

---

Notable Data Breaches: A Timeline

Year	Company	Records Exposed	Primary Cause
2013	Adobe	153 million	SQL injection
2014	Yahoo	3 billion	Credential theft
2016	LinkedIn	164 million	Password cracking
2017	Equifax	147 million	Unpatched vulnerability
2018	Facebook	533 million	Data scraping
2019	Capital One	106 million	Misconfigured cloud storage
2020	Marriott	5.2 million	Credential compromise
2021	T-Mobile	76.6 million	Server breach
2022	Twitter	5.4 million	API vulnerability
2023	MOVEit	77 million	Zero-day vulnerability
2024	National Public Data	2.9 billion	Database breach
2025	Various healthcare	100+ million combined	Ransomware attacks

Lessons from these breaches

Equifax (2017): A known vulnerability in Apache Struts went unpatched for months. When Equifax finally patched it, the breach had already occurred. Lesson: patch management is critical.

Capital One (2019): A misconfigured web application firewall allowed an attacker to access data stored in AWS. Lesson: cloud security requires careful configuration.

T-Mobile (2021): Attackers used stolen credentials to access internal systems. Lesson: strong authentication and access controls are essential.

---

How to Check If Your Data Has Been Breached

Using Have I Been Pwned (HIBP)

Have I Been Pwned (haveibeenpwned.com) is the most widely used free tool for checking whether your data has appeared in known breaches. Created by security researcher Troy Hunt, it aggregates data from hundreds of breaches and allows you to search by email address.

How to use HIBP:

1. Visit haveibeenpwned.com
2. Enter your email address
3. Review the list of breaches your email appeared in
4. Note the type of data exposed in each breach

Using GeneratePass Breach Checker

Our Breach Checker allows you to check if your email or credentials have appeared in known data breaches. All checks are performed client-side — your data never leaves your browser.

Other breach notification services

• Google’s Password Checkup (built into Chrome): Checks saved passwords against known breaches
• Firefox Monitor: Sends alerts when your email appears in new breaches
• DeHashed: Advanced search tool for leaked credentials

What to do when you find your data in a breach

Finding your data in a breach is alarming but not hopeless. The key is to act quickly and systematically.

---

What to Do After a Data Breach: Step-by-Step

Step 1: Change compromised passwords immediately

Go to every account that used the breached password and change it. Use a strong, unique password for each account. Generate new passwords with our Password Generator and verify their strength with our Password Strength Checker.

Step 2: Enable two-factor authentication

Enable 2FA on every account that supports it. Use an authenticator app (Google Authenticator, Authy) or a hardware security key. Avoid SMS-based 2FA when possible, as it is vulnerable to SIM-swapping attacks.

Step 3: Check for unauthorized activity

Review your accounts for signs of unauthorized access:

• Check email for password reset confirmations you did not initiate
• Review financial statements for unauthorized transactions
• Check social media for posts or messages you did not send
• Review account settings for changes you did not make

Step 4: Monitor your credit

If financial data or your Social Security number was exposed:

• Place a fraud alert with the three credit bureaus (Equifax, Experian, TransUnion)
• Consider a credit freeze to prevent new accounts from being opened in your name
• Review your credit reports for unauthorized accounts

Step 5: Watch for targeted phishing

After a breach, you are more likely to receive targeted phishing emails. Attackers may use information from the breach to craft convincing messages. Be extra vigilant about any communication that references your personal information.

Step 6: Update security questions

If security questions were exposed, update them on all accounts. Use nonsensical answers stored in your password manager rather than truthful answers that could be found on social media.

Step 7: Consider identity theft protection

If sensitive personal information was exposed (SSN, financial data), consider enrolling in an identity theft monitoring service. Many breached companies offer free monitoring to affected users.

---

Preventing Future Breaches

Use unique passwords everywhere

The single most effective thing you can do to limit breach damage is to use a unique password for every account. If one site is breached, attackers cannot use those credentials elsewhere. Our Password Generator creates cryptographically secure random passwords that are impossible to guess.

Enable 2FA on critical accounts

Prioritize two-factor authentication on:

• Primary email accounts
• Banking and financial services
• Cloud storage (Google Drive, Dropbox, iCloud)
• Social media accounts
• Password manager vault

Use a password manager

A password manager generates, stores, and autofills unique passwords for all your accounts. You only need to remember one strong master password. Learn more in our guide on why password managers matter.

Monitor your accounts regularly

Set up breach notifications and regularly check your accounts for unauthorized activity. Use our Breach Checker to monitor whether your credentials appear in new breaches.

Minimize your exposure

Reduce the number of accounts you maintain. Delete old accounts you no longer use. Provide minimal personal information when creating new accounts. The less data a company has about you, the less can be exposed in a breach.

---

Frequently Asked Questions

How do I know which passwords to change after a breach?

Start with the specific account that was breached. Then change any other accounts where you used the same or a similar password. Use our [Breach Checker](/breach-checker) to identify which of your credentials have appeared in known breaches. Prioritize email, banking, and social media accounts.

Is it safe to continue using a service after it has been breached?

In most cases, yes — provided the company has addressed the vulnerability and you have taken protective steps (changing passwords, enabling 2FA). Check the company's breach response: did they notify users promptly? Did they offer remediation? Did they patch the vulnerability? If the company has a history of multiple breaches, consider whether the service is worth the risk.

Should I pay for identity theft protection after a breach?

Many breached companies offer free identity theft monitoring to affected users. Take advantage of these offers. For ongoing protection, monitor your credit reports directly through AnnualCreditReport.com (free weekly reports) and consider placing a credit freeze, which is free and provides stronger protection than monitoring alone.

Can I remove my data from breach databases?

Once data has been exposed in a breach, it cannot be removed from breach notification databases like HIBP — the data is already in the hands of attackers. However, you can protect yourself by changing passwords, enabling 2FA, monitoring accounts, and placing credit freezes. Focus on defense rather than removal.

How often should I check for breaches?

Set up automatic breach notifications through HIBP, Firefox Monitor, or your password manager's built-in monitoring. Additionally, manually check your email and critical accounts every 3-6 months. After any major news of a breach at a service you use, check immediately.

---

References

1. Identity Theft Resource Center. “Annual Data Breach Report 2025.” https://www.idtheftcenter.org/
2. Have I Been Pwned. “Breaches, Passwords, and Compromised Accounts.” https://haveibeenpwned.com/
3. SpyCloud. “2024 Annual Identity Exposure Report.” https://www.spycloud.com/
4. NIST. “Guide to Protecting the Confidentiality of Personally Identifiable Information (PII).” SP 800-122. https://csrc.nist.gov/
5. Verizon. “2025 Data Breach Investigations Report (DBIR).” https://www.verizon.com/business/resources/reports/dbir/
6. Troy Hunt. “Lessons from the Trenches of Data Breaches.” https://www.troyhunt.com/

---

About the Author

The GeneratePass Editorial Team builds privacy-first security tools that run entirely in your browser. Every tool on GeneratePass processes data locally — nothing is ever sent to a server. Visit generatepass.me to try our free Password Generator, Entropy Calculator, and Breach Checker.