What Is a Data Breach and How Does It Happen?

Breaches sound technical, but the idea is simple: information ended up where it should not be. Here is how that happens and what it means for you.

By Siddharth ShankarUpdated October 11, 2026

You will hear about data breaches in the news, in emails from companies and in alerts from breach-checking services. The term gets used loosely, so it helps to pin down what it means and where the risk to you actually sits.

What a data breach is

The US National Institute of Standards and Technology (NIST) defines a breach as the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence involving data. The UK Information Commissioner's Office (ICO) puts it in terms of personal data: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.

Notice two things. A breach does not have to involve a hacker, and it does not have to be deliberate. The ICO says causes can be accidental or deliberate. Have I Been Pwned, the best-known public breach database, describes the incidents it lists as data inadvertently exposed in a vulnerable system, usually due to insufficient access controls or security weaknesses.

How breaches happen

The ICO's examples show the range of causes:

• Access by an unauthorised third party, such as an attacker who steals data from a server.
• Sending data to the wrong recipient, for example an email with the wrong attachment.
• Lost or stolen devices that hold personal data.
• Unauthorised changes to personal data.
• Loss of availability, where an organization can no longer reach data it needs.

The US Federal Trade Commission adds scenarios from the business side, including an insider stealing customer information, information inadvertently exposed on a company website, stolen credentials and mail theft.

For most consumers, the situations they hear about are the first and fourth: attackers who steal a database, and credentials that were captured and reused. A related pattern is malware on personal devices that records what you type, which we explain in what a stealer log breach is.

What information gets exposed

The data involved depends on what the organization held. Common categories include:

• Email addresses and usernames
• Passwords, sometimes stored in hashed form
• Names, phone numbers and physical addresses
• Dates of birth
• Government identifiers or financial details in the most serious cases

Have I Been Pwned's data classes now number 165, which gives a sense of how varied the leaked fields are, from passwords and phone numbers to browsing histories and government-issued IDs. We explain what each kind means in what each type of breached data means.

Breach versus leak

People use "data leak" and "data breach" interchangeably. We have not found an official source that formally separates them, so we use "breach" for any incident where data left the control of the organization that held it, whatever the cause. Some leaks come from misconfigured storage rather than an attack, and the consequence for you is similar.

Breach versus identity theft

A breach is an event affecting an organization. Identity theft is when someone uses your information without permission. A breach can lead to identity theft, but most people in a breach never experience it. Our identity theft explainer covers the difference.

How you find out you were in one

You usually learn in one of three ways: a notice from the affected company, a media report or a breach-checking service. Be careful with notices, because criminals imitate them. Our guide on telling a real breach notice from phishing shows what to check.

To look yourself up, use a trusted breach database and enter only your email address. HIBP's own limits are worth knowing: it holds only a subset of breached records, and "absence of evidence is not evidence of absence". Read how to check if your email address has been exposed.

What to do next

If your details appear in a breach, the most useful immediate steps are to change the password for that service and any account that used a similar one, turn on multi-factor authentication and consider a password manager. The FTC gives the same advice. Then follow your email was in a data breach: what to do next.