What is a data breach?
A data breach is an incident where an organisation's stored data is accessed or removed by someone unauthorised. For passwords, the exposed data is usually a database of hashes. Those hashes are only as protective as the method that created them, and weak hashing can turn a breach into rapid password disclosure.
- Topic
- Attacks
- Also called
- security breach, data leak
- Reading time
- 1 min
- Reviewed
On this page
What actually leaks
Rarely plaintext passwords. Usually a table of email addresses paired with password hashes, plus whatever else the service stored. The severity depends almost entirely on the hashing: an unsalted SHA-1 database is effectively cracked within hours, while bcrypt or Argon2 with a proper cost factor buys years.
Breaches also expose details people forget are stored, including password hints, security question answers, and partial payment information. Those records can matter as much as the password itself.
Why one breach becomes many
Attackers do not stop at the breached service. They take the recovered email-and-password pairs and replay them everywhere, which is why a leak at a forum you forgot about can end with your email account compromised. Unique passwords sever that chain completely.
Sources
These primary references support the terminology and current security guidance used in this definition.
