What is a data breach, and what should I do?

A company you use got hacked. Here's what that means and the steps that matter.

⏱ 5 min read · ▶ 1:13 video
The short version

A data breach is when information a company holds about its customers, like emails, passwords, addresses or card numbers, gets stolen or exposed. It’s usually not your fault, but a few quick steps limit the damage.

What gets stolen, and why it matters

  • Email and password: criminals try the same combination on other sites. This is why reusing passwords is risky.
  • Name, phone, address: used to make scam calls and texts more convincing.
  • Card numbers: used for fraudulent purchases.
  • Social Security number, date of birth: can be used for identity theft, like opening accounts in your name.
Think of it like this: a breach is like a gym’s locker key copies getting stolen. If your locker key also opens your house and car (a reused password), you need new locks everywhere.

What to do after a breach notice

  1. Change that site’s password, and anywhere else you used the same one.
  2. Turn on two-step verification, starting with email and banking.
  3. Watch your statements and report charges you don’t recognize.
  4. If your SSN was exposed, consider a free credit freeze at all three credit bureaus (Equifax, Experian and TransUnion). It blocks new accounts in your name until you lift it.
  5. Expect scams that mention the breach. Don’t click links in “breach” emails; go to the company’s site yourself.

What it means for you

You can’t prevent companies from being hacked, but unique passwords and two-step verification mean one breach doesn’t become many. If your identity is misused, IdentityTheft.gov (from the FTC) gives a step-by-step recovery plan.

Quick tips

  • Use a password manager so every password is different.
  • Run your password manager’s security check; it can flag passwords found in breaches.
  • A credit freeze is free and doesn’t affect your credit score.
  • Be extra wary of calls or texts that mention a breach and ask you to “verify” details.

Test yourself: play Password Strength Challenge or Scam or Legit?, quick free games.

🛠️ Try it step by step

More in our How-To guides.

📖 Words to know

Data breach Identity theft Credit freeze Password reuse Password manager