What Each Type of Breached Data Means for You

A breach notice lists data types, but not what they mean for you. This guide ranks them by risk and tells you what to do for each.

By Siddharth ShankarUpdated October 11, 2026

A breach notice or a lookup result often reads like a checklist: email addresses, passwords, dates of birth, physical addresses. It rarely tells you which item matters most. Have I Been Pwned currently tracks 165 data classes, so the lists can get long.

This page is a plain-language guide to the most common categories and a sensible order for responding. The risk ratings are our own judgment based on how each data type can be misused. Official agencies give type-specific steps mainly for passwords and Social Security numbers, so treat the rest as guidance rather than rules.

Passwords

Passwords carry the highest immediate risk because they can open accounts. What matters is whether the password was stored in plain text or hashed, and whether you reused it. Hashed passwords can still be cracked if they are weak. The FTC's advice is to change the password for the affected company and for any account with a similar password, and to turn on multi-factor authentication.

Read credential stuffing explained to see how one leak spreads to other accounts.

Email addresses and usernames

On their own, email addresses are low risk but widely useful to criminals. They feed phishing and spam lists and link your accounts together. See what an exposed email address means.

Phone numbers

A phone number can be used for scam calls, text phishing and, in some cases, SIM-swap attempts. Because a phone number rarely changes, exposure lasts. Our guide on what to do if your phone number was in a data breach covers carrier PINs and safer authentication.

Physical addresses

Home addresses matter because they are hard to change and can be combined with other data. They help criminals send convincing mail, redirect packages or guess security answers. They also raise personal safety concerns for some people.

Dates of birth

A date of birth is a common identity check, and you cannot change it. Combined with your name and address, it supports impersonation. By itself it is moderate risk. The more of these identifiers a thief holds together, the more convincing they become.

Government ID numbers

Social Security numbers, passport numbers and driver's license numbers are the most serious identifiers. They can support new-account fraud, tax fraud and benefits fraud. If these were exposed, consider a credit freeze and read what to do if your Social Security number was leaked.

Financial data

Card and bank account numbers should be handled with the issuer immediately. Report unrecognized charges, ask for a replacement card and monitor statements. Card numbers are replaceable, which makes them less damaging than permanent identifiers.

IP addresses, usernames and browsing data

These can reveal approximate location and habits. They rarely lead directly to fraud but add to a profile of you. Their main risk is being combined with other leaked data.

A quick priority order

1. Exposed passwords or authentication tokens: change them and enable multi-factor authentication. 2. Government ID numbers: freeze credit and watch for misuse. 3. Financial data: contact the issuer and review statements. 4. Phone numbers and addresses: expect scams and tighten account recovery settings. 5. Dates of birth and emails: reduce reuse and watch for phishing.