You can do everything right and still have your password leak, because the weak point can be a company you trust. No technical knowledge is needed for this explainer. It is part of our guide to data breaches and hacked accounts.
What a data breach is
A data breach is any event in which private information leaves a company's control. That might be names, emails, passwords, addresses, phone numbers or payment details.
Most breaches happen in one of a few ways:
- An attacker finds a flaw in a company's website.
- An employee is tricked by phishing.
- Staff passwords are stolen or reused.
- A supplier is hacked and customer data goes with it.
- Someone leaves a database open on the internet by mistake.
How your password gets exposed
Good websites never store your actual password. They run it through a one-way scrambling process and keep the result, called a hash. When you log in, they scramble what you type and compare.
If a site is breached, attackers get the hashes. They can then guess passwords at huge speed on their own hardware. Common and short passwords fall quickly. Long random passwords usually survive. Read how hackers crack passwords for more.
Badly run sites may store passwords with weak protection, or even in plain text. In that case, length does not help, which is why you must use a different password everywhere.
What criminals do next
| Step | What happens |
|---|---|
| Sell or share | Stolen lists are traded on criminal forums |
| Try everywhere | Bots test the logins on other sites, known as credential stuffing |
| Target you | Personal details make phishing emails more convincing |
| Commit fraud | Details are used for identity theft |
Why you should care about old breaches
Stolen data does not expire. A password from a forum you used ten years ago may still work on an account you use today if you reused it.
What to do
- Check whether your details were exposed.
- Follow our step-by-step breach response.
- Use a password manager, so that one leak can only ever affect one account.
- Add two-factor login, so that a stolen password is not enough.