Data Breach Information: Types, Causes, and What to Do

Data breaches have become so routine that they no longer shock. A retailer, hospital, software provider or government contractor announces that records were exposed, and a familiar sequence follows. Underneath the routine are real consequences for real people. This guide collects the essential information about data breaches in one place: what they are, how they happen, what gets stolen, how notification works, what to do and how to lower your risk before the next one. For a definition, see our short explainer on what a data breach is.

1. What counts as a data breach

A data breach is any incident in which protected information is accessed, disclosed or lost without authorization. It does not require sophisticated hackers. A misconfigured database that anyone can read, an employee emailing a spreadsheet to the wrong person or a stolen laptop can each qualify. Some definitions focus on confidentiality; others include loss of availability or integrity, as in ransomware attacks that lock systems.

2. How breaches happen

Cause	How it works
Phishing	Deceptive messages trick staff or users into revealing credentials or installing malware
Stolen or reused credentials	Attackers log in using passwords from earlier leaks
Unpatched software	Known vulnerabilities are exploited before fixes are installed
Misconfiguration	Cloud storage or databases are left open to the internet
Malware and ransomware	Malicious code steals or encrypts data
Third-party compromise	A vendor or supplier is breached
Insider misuse	Employees or contractors take or leak data
Physical loss	Devices, paper files or drives are lost or stolen
Social engineering	Attackers impersonate staff, vendors or customers

Our article on the attack on InfoTrax shows how a vendor failure can ripple to others.

Curious what’s already out there? Wiperts’ 100% Free Diagnosis shows which data brokers are listing your name, home address and phone number. Check your exposure free — it takes about a minute.

3. What information gets stolen

The type of data determines the risk.

Credentials: emails and passwords lead to account takeover.
Financial data: card numbers and bank details lead to fraudulent charges.
Identity data: birth dates and government ID numbers enable new-account fraud.
Contact data: phone numbers and addresses fuel scams and stalking.
Health data: diagnoses and insurance details lead to medical identity theft and extortion.
Behavioral data: location histories and communications can be used for blackmail or targeting.

The FBI’s Internet Crime Complaint Center received 67,456 personal data breach complaints in 2025, with about $1.31 billion in reported losses (ic3.gov).

4. How you are notified

Every U.S. state has a breach notification law that requires organizations to notify affected residents in certain circumstances. Timelines and triggers vary. Notices usually explain what happened, what information was involved and what the organization is doing. Some include an offer of credit monitoring. Because scammers send fake notices, verify any message independently by visiting the organization’s official website or calling a known number.

5. What to do after a breach

Verify the notice

Do not click links in the message. Confirm it through an official channel.

Change passwords and enable two-factor authentication

Start with the exposed account and any other account using the same password. Prefer an authenticator app or passkey.

Freeze your credit

A freeze is free and blocks most new-account fraud. See what a credit freeze is and the FTC’s guidance.

Monitor accounts and reports

Review statements and credit reports, and set alerts.

Watch for phishing

Expect messages that refer to the breach. Verify before responding.

Report misuse

File at IdentityTheft.gov if your identity is used, and report scams at ReportFraud.ftc.gov. Our guides on data breach response strategies and responding to personal data theft offer detailed checklists.

Reduce public exposure

Take down listings that complete stolen records. Official pages include Spokeo, PeopleConnect and That’s Them. Our removal guide walks through the process.

6. Famous breaches and what they teach

Large incidents illustrate recurring themes. The 2017 Equifax breach, which affected about 147 million people, showed how permanent identity data can be exposed at scale. Our articles on Equifax, the three biggest data breaches and the Marriott breach review notable cases. Common lessons include the importance of patching quickly, limiting data retention, monitoring for intrusions and disclosing clearly.

7. What breaches cost

Costs include investigation, notification, legal fees, regulatory penalties and lost business for organizations, plus fraud losses, time and long-term risk for individuals. See our analysis of what data breaches cost and the way companies typically respond in an inefficient cycle. Because identity data is permanent, risk can persist for years, as discussed in how long data leaks can affect you.

8. How to lower your risk before the next breach

Use unique passwords with a password manager.
Enable two-factor authentication.
Freeze your credit now.
Share less data and use alias emails.
Delete accounts you no longer use.
Pay with credit cards rather than debit for online purchases.
Remove public listings so stolen records are less useful.
Keep devices and apps updated.

9. Where to get help

The Federal Trade Commission provides consumer guidance and recovery tools. The FBI’s Internet Crime Complaint Center accepts reports of internet-enabled crime. The Consumer Financial Protection Bureau handles complaints about financial products and credit reporting. For health data, the HHS Office for Civil Rights explains HIPAA rights. California residents can learn about rights from the California Privacy Protection Agency.

10. Timeline: after a breach notice

When	Action
Day 1	Verify, change passwords, enable two-factor authentication
Day 2	Freeze credit
Week 1	Review statements, set alerts
Month 1	Remove public listings
Quarterly	Review reports
Yearly	Full review

11. The anatomy of a breach timeline

Understanding how breaches unfold helps you interpret news and notices. An intrusion begins on a particular day, but it is often not discovered for weeks or months. After discovery the organization investigates, which can take more time, then decides what to disclose. Notification letters may arrive months after the original intrusion. By then, stolen data may already have been sold or used. This delay is why acting on any notice immediately, and keeping defenses such as freezes and two-factor authentication in place all the time, works better than waiting.

12. Breach notifications and fake notices

Because breach letters are now common, criminals imitate them. A fake notice may use urgent language, include a link to a lookalike site and ask for your birth date or government ID number to “verify” your record. Real notices rarely require you to provide sensitive details to receive information. If you receive one, verify through a known website or phone number and check the state attorney general’s breach listing if your state publishes one. When in doubt, report suspicious messages to ReportFraud.ftc.gov.

13. What organizations should tell you

A good notice describes the incident in plain language, lists the types of information involved, says when the breach happened and was discovered, explains what the organization is doing, offers specific steps you can take and provides a contact point. If a notice is vague about which data was exposed, ask. If the organization offers a service such as credit monitoring, read the enrollment terms, since they may include arbitration clauses or marketing consent. You can always decline the offer and still protect yourself with a free credit freeze.

14. Small businesses and breaches

Small businesses are not immune. They hold customer lists, payment data and employee records, often with fewer defenses. If you run one, practice the basics: unique passwords, two-factor authentication, updates, backups, staff training and a simple incident plan. The FTC publishes guidance for businesses on protecting personal information and responding to breaches. Knowing in advance whom to call, such as your payment processor, your insurer and local law enforcement, saves time on the worst day.

15. Learning from each incident

Every breach offers a lesson you can apply. Did the company hold more data than it needed? You can give less. Did attackers use reused passwords? You can use unique ones. Did exposed contact details lead to scams? You can reduce public listings. Treat each news story as a prompt to review one habit, and over time your exposure shrinks.

16. Three scenarios and what to do

Scenario 1: A retailer notifies you of a payment card exposure. Replace the card and monitor charges.

Scenario 2: A breach lists your email and an old password. Change that password everywhere it was used.

Scenario 3: A letter says your government ID number was exposed. Freeze credit and monitor for tax and benefit fraud.

17. Myths and facts

Myth	Fact
Only large companies are breached	Small organizations and vendors are common targets
Breaches only matter if money is stolen	Identity data is misused later
The organization will fix everything	Remedies are limited
I would know if I was affected	Many people learn late
A new password solves it	Permanent data stays exposed

18. Common mistakes

Ignoring notifications.
Reusing passwords.
Trusting unverified breach emails.
Skipping a freeze.
Leaving public listings online.
Relying only on monitoring.

19. Questions to ask yourself

Which of my accounts share a password? Is my credit frozen? Could someone complete my profile from public listings? Do I know where to report? Fix the weakest answer.

20. How Wiperts fits

You cannot stop breaches, but you can limit what they reveal when combined with public data. Wiperts scans more than 100 data brokers and people-search sites, submits removal requests, removes personal results from Google and Bing, blurs your home on maps and monitors for returning profiles. Start with the free diagnosis.

100% Free Diagnosis: Check Your Exposure

Find out what data brokers have on you. Enter your details in the free scanner on the Wiperts homepage:

First Name
Last Name
Select State
Email Address
Website

Scan Databases Now — no payment is needed to see your exposure report.

21. Key takeaways

Breaches stem from phishing, weak credentials, unpatched software, misconfiguration and vendors.
Verify notices, change passwords and freeze credit.
Identity data stays risky for years.
Reduce public listings to make stolen records less useful.

Pick the Wiperts plan that fits your household

Plan	Covers	One-time deep scrub	Then
Individual	1 person	$89	$14/month
Couples (most popular)	2 people	$149	$24/month
Family	Up to 4 people	$199	$39/month

Every plan includes removal of your name, date of birth, salary, home address and phone number from 100+ data brokers and people-search sites, Google and Bing search-result removal, home blurring on maps, and 24/7 monitoring that re-removes your data if it reappears. See plans and start your removal

22. Frequently Asked Questions

What is a data breach?

A data breach is an incident in which unauthorized people gain access to confidential or protected information, whether through hacking, error, theft or misuse.

What causes most data breaches?

Common causes include phishing, stolen or reused credentials, unpatched software, misconfigured cloud storage, malware, insider misuse and lost devices.

How will I know if I was affected?

You may receive a notification letter or email from the organization, and you can check reputable breach-notification services for your email address.

What data is typically stolen?

Names, email addresses, passwords, phone numbers, addresses, birth dates, government ID numbers, payment cards and sometimes medical or account data.

What should I do first?

Verify the notice independently, change affected passwords, turn on two-factor authentication and freeze your credit.

Can breaches be prevented?

Organizations can reduce risk with security controls, but individuals should assume some breaches will occur and limit damage through unique passwords, freezes and less data sharing.

Sources

Ready to erase your footprint?

Stop letting data brokers profit from your personal life. Start your removal today.

Start Removing