What is a data breach?

A data breach is what happens when information a company holds about you ends up in hands it was never meant for. Sometimes an attacker walks out with a full copy of a user database. Sometimes an employee leaves a storage bucket open to the internet and someone finds it. Either way, the result is the same: records with your email address, and often much more, are now circulating somewhere you cannot see.

The word "breach" suggests a single dramatic event, but for the person whose data is in the file, it is closer to a slow leak. The copy that left the building does not stay with one attacker. It gets traded, merged, repackaged, and resold, and each of those steps can happen months or years after the original incident.

A breach is a copy, not a theft

When a car is stolen, it is gone. When a database is stolen, the company still has it, and so does the attacker, and soon so does everyone the attacker shares it with. That difference matters. You cannot get breached data back, and no company can promise the leak has been contained, because containment is not a thing that exists for information.

What a breached record contains varies a lot. The mild end is an email address and a username. The severe end is a plaintext password, a phone number, a home address, a date of birth, or answers to security questions. A plaintext password is the worst case: paired with your email, it is a working key to every account where you reused it.

Where the data goes next

Fresh breach dumps tend to start in private circles: the attacker sells access to a small number of buyers, who quietly exploit the credentials while they still work. Over time the data loses exclusivity and spreads outward, first through paid forums, then through free public dumps that anyone can download.

Along the way, credentials get extracted into combolists: huge text files of email-and-password pairs stitched together from many breaches. Combolists exist for one purpose, credential stuffing, where automated tools try each pair against banks, email providers, game stores, and streaming services. If you have ever had an account "hacked" on a site that was never breached itself, a combolist is the likely reason.

The long tail: breaches surface late

Here is the part most people underestimate. The average breach is not discovered for months, and the stolen data often stays private for years before it shows up anywhere a researcher can index it. A breach from 2019 can surface in 2026 with your current password in it, because you have been using that password the whole time.

This is why checking your email against a breach database once tells you very little. The answer you get is only true for that moment. Next week a new dump drops, an old private collection goes public, or your address lands in a fresh combolist, and the answer changes. Exposure is a moving picture, and a one-time lookup is a single frame of it.

What to do when your address shows up

• Change the password on the breached account first, then on every other account where you used the same or a similar password.
• Switch to a password manager so every account gets its own random password. This one habit ends the combolist threat for you almost entirely.
• Turn on two-factor authentication for email, banking, and anything holding payment details. An authenticator app beats SMS codes.
• Watch for phishing that references the breach. Attackers use leaked details to make their emails look convincing, so be slow to click anything that arrives unprompted.
• If a password was exposed in plaintext, treat every account that ever used it as compromised, even ones you have forgotten about.

Keeping watch

None of the steps above help if you never learn your address leaked in the first place, and companies are not reliable narrators of their own incidents. The practical fix is standing coverage: something that watches breach databases and active combolists for the addresses you own and tells you the day the picture changes, not the day a journalist writes about it.

That is the entire job Breachtide does. It sweeps four independent breach feeds on a continuous schedule, keeps state per address, and sends one alert when your exposure genuinely changes, with severity that tells you whether to change passwords now or just stay aware. If that standing watch sounds more useful than a one-off lookup, monitoring your first address is free.