# What is a data breach?

> An incident in which data held by an organisation is accessed or taken by someone not authorised to have it.

Last reviewed: 2026-09-01

## Data breach

Category: Attacks

Also called: security breach, data leak

Canonical page: https://moolkey.com/glossary/data-breach

A data breach is an incident where an organisation's stored data is accessed or removed by someone unauthorised. For passwords, the exposed data is usually a database of hashes. Those hashes are only as protective as the method that created them, and weak hashing can turn a breach into rapid password disclosure.

### What actually leaks

Rarely plaintext passwords. Usually a table of email addresses paired with password hashes, plus whatever else the service stored. The severity depends almost entirely on the hashing: an unsalted SHA-1 database is effectively cracked within hours, while bcrypt or Argon2 with a proper cost factor buys years.

Breaches also expose details people forget are stored, including password hints, security question answers, and partial payment information. Those records can matter as much as the password itself.

### Why one breach becomes many

Attackers do not stop at the breached service. They take the recovered email-and-password pairs and replay them everywhere, which is why a leak at a forum you forgot about can end with your email account compromised. Unique passwords sever that chain completely.

Further reading: [Check whether a password has been breached](https://moolkey.com/tools/password-breach-check)

### Sources

- [Have I Been Pwned: Pwned Passwords](https://haveibeenpwned.com/Passwords): A searchable corpus of password hashes exposed in known data breaches.
- [OWASP: Password Storage Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html): Practical guidance for salts, peppers, PBKDF2, Argon2id, and password hashes.
- [CISA: Secure Our World](https://www.cisa.gov/secure-our-world): Public guidance for recognizing phishing and protecting high-value accounts.
- [NIST: Computer Security Resource Center glossary](https://csrc.nist.gov/glossary): Canonical terminology used across US computer security guidance.