What Happens to Your Data After a Breach

You got the email. "We regret to inform you that your data may have been compromised in a recent security incident." Great. But what does that actually mean? Where does your data go? Who has it? And should you be worried?

Let's break it down.

## What this guide covers

- What a data breach actually is - Where your stolen data ends up - What criminals do with it - What this means for you specifically - What you can do about it

---

## What Is a Data Breach?

A data breach is when someone gains unauthorised access to a system and takes data that wasn't meant to be public. That system could belong to a company you have an account with, a government agency, a hospital, a school — anyone who stores your information.

What gets taken depends on what was stored. It could be:

- Email addresses and passwords - Full names and physical addresses - Phone numbers - Credit card or bank account details - Government ID numbers (social security, passport, etc.) - Medical records - Private messages or photos

Sometimes it's just emails and passwords. Sometimes it's everything.

---

## Where Does Your Data Go?

Here's where it gets interesting — and a bit unsettling.

### Stage 1: The hacker has it

Right after a breach, the stolen data sits with whoever took it. Sometimes that's a single person, sometimes it's an organised group. At this point, they have a few options.

### Stage 2: It gets sold

Most stolen data ends up for sale on dark web marketplaces — think of them as underground eBay for stolen information. Prices vary depending on what was taken.

Email and password combinations are cheap — sometimes fractions of a cent each, sold in bulk. Credit card details go for more, especially if they include the security code and billing address. Full identity packages (name, date of birth, government ID, address, bank details) are the most valuable — they're called "fullz" in criminal slang, and they give a buyer everything they need to become you.

### Stage 3: It gets used

Buyers use stolen data in different ways depending on what they have.

**Login credentials** get fed into automated tools that try them across hundreds of websites. If you reused your password (and most people do), they can break into your other accounts without any hacking at all. This is called credential stuffing.

**Financial data** gets used to make purchases, drain accounts, or create counterfeit cards.

**Full identity packages** get used for identity theft — opening credit accounts, filing tax returns, applying for benefits, or even committing crimes in your name.

**Email addresses** (even without passwords) have value. They get added to spam lists, used in phishing campaigns, or combined with other leaked data to build a more complete profile of you.

### Stage 4: It gets shared — forever

Here's the uncomfortable truth. Once your data is out there, it doesn't come back. Stolen databases get copied, reshared, merged with other breaches, and passed around for years. A breach from five years ago can still affect you today if you haven't changed your passwords since then.

---

## "But I'm Not Important Enough to Target"

This is the most common thing people say, and it's the most dangerous assumption. You don't need to be important. Cybercriminals don't target individuals — they target volume. If your email and password are in a breach, they're in a list alongside millions of others, being fed into automated tools. The computer doesn't know or care who you are. It just tries every combination until something works.

---

## How Do You Know If Your Data Has Been Breached?

Sometimes the company tells you. Sometimes they don't — or they take months to disclose it.

There are free services that let you check if your email address has appeared in known breaches. These can give you a sense of what's already out there. Check your country's cyber authority or our Resources page for trusted options.

> **Find trusted tools and reporting options on our [Resources page].**

---

## What You Can Do About It

You can't undo a breach, but you can limit the damage and protect yourself going forward.

**Change the password for any account involved in the breach.** If you used that same password anywhere else (be honest), change it there too.

**Turn on two-factor authentication.** This makes your password alone not enough to access your account.

> **See our guide: *Set Up 2FA in 5 Minutes (And Why You Should)***

**Watch your financial accounts.** Keep an eye out for unfamiliar transactions over the coming weeks and months.

**Consider a credit freeze or fraud alert** if sensitive financial or identity information was included in the breach.

> **Find out how on our [Resources page] — options vary by country.**

**Use unique passwords for every account.** A password manager makes this painless. That way, one breach doesn't hand over the keys to your entire digital life.

**Stay alert for phishing attempts.** After a breach, scammers often use the stolen data to craft convincing phishing emails. If you get a message referencing the breach and asking you to "verify your account," go directly to the company's website instead of clicking the link.

> **Want to understand phishing better?** Read our guide: *How Phishing Scams Actually Work*

---

## The Bigger Picture

Data breaches aren't your fault. You trusted a company with your information and they failed to protect it. That's on them.

But the reality is that breaches happen constantly, and the best thing you can do is assume your data is already out there and act accordingly. Use unique passwords, turn on 2FA, and stay aware. It's not paranoia — it's just how things are now.

> **Been affected by a breach?** Visit our [Stories page] to hear from others who've been through it.

---

*This guide is part of the StillOnline.org explainer series. Written in plain language for real people who want to understand what's actually going on.*