What Is a Data Breach? (And What To Do If Your Data Is Stolen)

A data breach is any unauthorized viewing, theft, or use of sensitive, personally identifiable information by a person, group, or software system. While some data breaches are unintentional or don’t contain sensitive information, others are due to cyberattacks, phishing schemes, malware, or even just human or software error, exposing your personal information to hackers or thieves.

Understanding how breaches happen, the potential effects on your life and finances, and how you can protect yourself from identity theft could go a long way toward mitigating any risks to your information.

How do data breaches happen?

Criminals are always looking to exploit stored information. Here are a few of the ways data breaches happen.

Human Error

Unfortunately, accidents happen, and an employee using an unsecured computer to access sensitive information could lead to a data breach.

Social engineering is a specific type of cyberattack that relies on human error. For example, an employee might find a USB drive in the parking lot and bring it inside. In an attempt to return it to the right person, they plug it in. Unfortunately, that USB drive contains malware that compromises your system.

Malicious intent

An employee might purposefully access or steal information without permission to harm the company or profit from the sensitive data. This can also include launching spyware or keyloggers, which capture your keyboard strokes, and even phishing attacks designed to get you to click on dangerous links.

Physical Theft

If an unsecured or unencrypted smartphone, laptop, or external hard drive containing sensitive information is lost or stolen, that data may find its way to people who use it to steal identities or otherwise cause problems. Similarly, someone can "steal" your credentials via a shoulder surfing attack. 

Hackers

Hackers, or people who use computers to gain unauthorized information, use a variety of ways to access personal data and other valuable information. Some of them include launching malware into an organization’s system, stealing credentials to gain access, or attacking a network if they find weak points.

Hackers may leverage the stolen data or make it available to other cybercriminals or dark web dealers. Additionally, hackers may use special software to guess passwords, which is one of many reasons why it’s essential to make sure you use strong passwords and protect yourself as much as possible.

How data breaches could affect you

Data breaches cause many problems and headaches for businesses and governments, leading to a loss of revenue, a damaged reputation, and potential legal consequences if the organization is found negligent. Companies could have trade secrets, intellectual property, and other confidential information exposed, which could affect their bottom line for years to come.

Small businesses are especially vulnerable to cyberattacks. For individuals, data breaches could expose crucial personal details such as:

• Social Security numbers
• Personal health information
• Banking information
• Credit card numbers
• Phone numbers
• Login information such as email addresses and passwords

Thieves could also steal your health insurance information to access health care (and potentially run up medical debt) under your name. They could even open utilities or buy a phone in your name.

Data breaches leave you vulnerable to credit card fraud, identity theft, and potential legal consequences depending on what is done in your name.

If you are a victim of identity theft, you may spend years trying to untangle the mess. You may need to file multiple police reports and report the crime to the FTC and the FBI’s Internet Complaint Center (ICC).

Identity theft could ruin your credit and cause massive financial problems, such as not being able to get a loan or mortgage, at least while the authorities try to sort out what happened.

A data breach could also mean a lot of time and headaches while contacting the credit bureaus and reviewing your credit reports and account statements for any inconsistencies.

If you discover fraudulent activity, you may need to freeze your credit report. If your banking information is compromised, you’ll need to go through the hassle of canceling and waiting for new credit and debit cards and updating all your payment information with various websites and any subscriptions you may have.

What to do if your info is stolen in a data breach

While figuring out how to stay safe online can be scary, remember that some basic precautions and swift action will help keep your information and finances secure. 

If you believe your information was part of a data breach, consider the following steps:

Watch for data breach notifications

Keep an eye out for data breach notifications from companies informing you that your information was exposed in a security incident. The notification will typically tell you the type of information compromised. Due to the breach, some companies may offer free identity theft protection, sometimes with credit monitoring.

Set up fraud alerts

Set up fraud alerts on your credit report with the three major credit bureaus (Experian, TransUnion, and Equifax).

Watch your accounts

Keep an eye on your bank accounts and credit cards and set up alert features so that you know if someone has gained access to your financial information.

If your financial statements show signs of compromise (unauthorized or attempted charges), report it immediately and ask that your credit and debit cards be canceled and reissued.

Monitor your credit

Monitor your credit reports for unusual activity and notify the bureaus immediately if you see fraudulent activity. Consider freezing your credit if suspicious activity appears. A credit freeze prevents potential new creditors from accessing your credit report unless you lift the freeze. 

It’s a more severe step than a fraud alert, which attaches a notice to your credit report that you’ve been a victim of fraud and advises businesses to contact you personally before extending credit.

Identity theft protection

Consider adding identity theft protection for the ultimate personal (of familial) coverage. These services can help prevent your information from being used by criminals to assume your identity. In addition, top services can help subscribers recover in the case of identity theft. 

How to prevent your info from being stolen in a data breach

While you can’t control what businesses do regarding data security, you can incorporate best practices in your personal life to minimize the chances of unauthorized access to your devices and accounts.

Review the following to help prevent identity theft and see how your security stacks up.

Software

• Keep your security and antivirus software up to date (if you need some ideas, check out our roundup of the best antivirus software).
• Keep your operating system and internet browsers up to date. Developers create new patches or software updates to help block out current phishing or malware schemes.
• Delete any unused accounts you no longer use. For example, you may have started a blog in 2001 and not logged in for a decade or more, so you could delete the account. Consumer Reports has a step-by-step guide on how to remove information from several websites.

Passwords and email

• Create and use strong passwords — the FTC recommends using this password checklist to ensure your passwords are as strong as possible.
• Enable two-factor or multi-factor authentication wherever it’s available and use an Authentication App.
• Choose security question answers carefully and make sure they aren’t easy to guess and that you’re the only one who knows the answers.
• Consider a password manager to help you generate and store strong passwords.
• Don’t click on any email, video, or web links that seem suspicious or sent from someone you don’t know.
• Use a website such as haveibeenpwned to help you discover what personal information is already on the web.

Home Security

• Secure your home Wi-Fi network by encrypting your network and changing your router’s default password(s). According to the FTC, you can encrypt your network by updating your router settings to WPA3 Personal or WPA2 Personal. If you have an older router, you may need to update your router software or buy a new router for increased security.
• Make sure your Wi-Fi network's hardware and software are up to date, which can help prevent a hacked router.
• Disconnect unused hardware or smart devices from the internet and disable features you don’t use.
• Be cautious about the types of smart products in your home and how they are configured. Remote access to devices may mean they could be hacked relatively easily, compromising your data protection.

FAQs

Bottom line

Having your personal and financial information stolen in a data breach can be frightening, especially considering how much of our information exists online. It’s essential to take the threat of cybercrime seriously. Use strong passwords and multi-factor authentication wherever possible, and keep your antivirus software and operating systems up to date.

If you haven’t yet, consider looking into identity theft protection services to help you keep track of your credit, bank accounts, and personal information.