A notification arrives that a service you use has been breached. Millions of records have been exposed. Your email address is in that list. The natural response is panic. The informed response is to understand what will actually happen to your data and what you should genuinely worry about.
Most breaches follow a predictable pattern, and understanding that pattern helps you focus your response.
What gets stolen
Most breaches expose:
Emails. Nearly always. Your email address is one of the most valuable pieces of information because it unlocks password resets.
Passwords. Usually in hashed form (encrypted), sometimes in plain text if the service was poorly designed. A modern hash is hard to crack, but weak passwords can be cracked quickly. Strong unique passwords are immune regardless.
Usernames and display names. Readily available and not particularly sensitive.
Purchase history and payment information. Often, but usually not in usable form. Credit card numbers, if actually stolen, are usually encrypted on the service and therefore not stolen in the breach.
Phone numbers and addresses. Common in larger breaches.
Security questions and answers. Sometimes, and surprisingly valuable for account recovery.
Authenticator codes and backup codes. Valuable if the attacker knows your email address and wants to take over your account immediately.
Where the data goes
Dark web marketplaces. Stolen data is sold in bulk. A database of 10 million records might be sold for £100-1,000. The buyer is typically a criminal organisation that specializes in fraud or identity theft.
Exposed on the internet. Sometimes it is posted publicly to shame the company or cause chaos rather than for financial gain. This is rarer than the marketplace route.
Held for ransom. The attacker contacts the company and offers to delete the data if the company pays. The company sometimes pays, sometimes does not.
Used by the attacker. Some breaches are not about reselling data. The goal is the credentials or the data itself. A disgruntled employee might steal data and use it themselves.
Forgotten. Surprisingly often, data is stolen, the attacker moves on to the next target, and the data is never monetised. It sits on an attacker’s hard drive or in storage until it is eventually deleted or lost.
The timeline of threat
Immediately after the breach. The most acute risk is if you have used the same password elsewhere. An automated attack will try that password on email, banking, and other major services. This is credential stuffing and it is extremely common.
Your email is the master key — if someone has your email and password, they can reset passwords on every other service.
Days to weeks. The data is sold or posted. Attackers start trying the credentials. If your password was weak, it might be cracked. If you used it elsewhere, those accounts are now at risk.
Weeks to months. If the stolen data includes security questions or answers, targeted account takeovers become possible. Someone uses the data to answer security questions and take over your account with your ISP or bank.
Months and beyond. Stolen data is used to build targeted phishing campaigns. An attacker who knows your email, previous passwords, hometown, and mother’s maiden name can craft a phishing email that is highly credible.
What you should actually do
Change the password immediately. Do this on the day you find out about the breach. Use a new unique strong password.
Check if the password was used elsewhere. If you reused passwords, change the password on other services too. This is urgent. Credential stuffing attacks happen immediately.
Enable or strengthen 2FA on the compromised service. If you did not have two-factor authentication, enable it now. If you did have it, check if backup codes are safe.
Monitor the account. Check for unusual activity. Look at login history. Set up alerts if available.
Credit monitoring. If the breach included payment information or personal details that could be used for identity theft, consider placing a fraud alert with your credit agency or monitor your credit for unusual activity.
Check password managers. If you use a password manager, check that the breached password is not the master password.
Update security questions. If you remember what the security questions were, change your answers. If the attacker knows the answers, they can take over your account.
What you do not need to worry about
Identity theft will definitely happen. Most people whose data is breached are never targeted for identity theft. The volume is high but the conversion rate is low. Most criminals move on to easier targets.
Your credit card will be charged. Payment information in breaches is usually encrypted on the service. If it was stored in plain text, yes, there is risk. But most legitimate services use payment processors that never handle raw card numbers. Fraud is possible but not inevitable.
Your accounts are definitely compromised. They might be, but probably not immediately. You have a window of time to act.
You need to change all your passwords. Change the password on the breached service and on any services where you reused the password. Your other passwords are fine if they were unique.
What the company should have done
For context: modern security best practice stores passwords using strong cryptographic hashing (like bcrypt or Argon2), which is hard to crack. It encrypts payment information at rest. It salts and hashes security question answers. It isolates authentication data from other data.
A breach at a well-designed service is less catastrophic than a breach at a poorly designed one. The difference between a sophisticated hash and a weak one is the difference between “this is annoying” and “I have to change all my passwords.”
Look at what was stolen. If the service lost plain-text passwords, find another service. If it lost hashed passwords, you are fine if you used a strong password. If it lost payment information, that is a sign of deeper problems.
Preventing the next breach from being catastrophic
Use unique passwords everywhere. A password manager makes this effortless. Every account has a different password. A breach of one service cannot cascade to others.
Enable 2FA on important accounts. Email, banking, cloud storage. An attacker with your password and email address cannot take over these accounts if 2FA is required.
Do not answer security questions honestly. Security questions are usually answerable with public information or information available in a breach. Make up an answer and remember it. Or use random characters if the system allows.
Monitor important accounts. Set up alerts for login attempts. Check activity monthly. Unusual activity is usually detectable if you are paying attention.
Assume every service will be breached. This is not pessimism; it is realism. Nearly every large service has been breached at some point. Design your security around that assumption.
The practical perspective
A breach is annoying but not catastrophic if you have unique passwords and 2FA. Millions of people have their data breached annually. The vast majority experience no fraud, no identity theft, no account takeovers.
The people for whom a breach is genuinely harmful are usually the ones with weak or reused passwords, or without 2FA on important accounts. If you have both, you are ahead of 90% of people.
A breach notification should trigger immediate action — change the password — and ongoing vigilance — monitor the account — but not panic.