What is a data breach? Definition + 8 biggest of 2025 + how to check if you're affected

A data breach is an incident where confidential, sensitive, or protected information is accessed, disclosed, or stolen by an unauthorized party. The 8 biggest data breaches of 2025 affected over 400 million people combined, including the Snowflake breach (110M customers), AT&T breach (73M customers), and Ticketmaster breach (40M customers). If your data was part of a breach, attackers can use it for identity theft, account takeover, phishing, or financial fraud. You can check if you were affected using Have I Been Pwned (HIBP), a free service that tracks 14+ billion breached records.

What is the definition of a data breach?

A data breach is any incident that results in unauthorized access to confidential data. This includes:

• Hacking — an attacker exploits a vulnerability to gain access
• Insider threat — an employee or contractor leaks or sells data
• Accidental exposure — a misconfigured cloud server, a lost laptop, a wrongly-addressed email
• Physical theft — a stolen device containing unencrypted data
• Ransomware — attackers encrypt data and demand payment (the data is exfiltrated before encryption)
• Supply chain attack — a vendor is breached, exposing your data via them

Types of data typically exposed:

• Personally Identifiable Information (PII) — name, address, Social Security Number (SSN), date of birth
• Financial data — credit card numbers, bank account numbers
• Health data — diagnoses, medications, insurance IDs (HIPAA-protected)
• Credentials — usernames, password hashes, security questions
• Behavioral data — browsing history, location history, purchase history

What makes it a "breach" (vs. a "leak"): The legal definition varies by jurisdiction, but generally a breach involves unauthorized acquisition (someone took the data), while a leak involves unauthorized exposure (data was made public but no one specifically took it). Both require disclosure under most privacy laws.

What are the 8 biggest data breaches of 2025?

#	Breach	Records exposed	Date disclosed	Type
1	Snowflake	110M	June 2025	Credential stuffing → cloud theft
2	AT&T	73M	July 2025	Insider threat via Snowflake
3	National Public Data (background check)	70M	April 2025	Misconfigured server
4	Ticketmaster	40M	May 2025	Snowflake-related
5	Santander	30M	May 2025	Vendor breach
6	PandaBuy	13M	March 2025	API vulnerability
7	Dell	49M	April 2025	Brute force on customer portal
8	Hot Topic	22M	November 2025	Credential stuffing

The Snowflake breach is the most consequential — Snowflake is the cloud data platform used by 9,000+ companies including AT&T, Ticketmaster, Santander, and 200+ Fortune 500 firms. The breach exploited customers who hadn't enabled multi-factor authentication, leading to a cascade of breaches at downstream companies. Snowflake's stock dropped 22% in the week after disclosure.

How do data breaches happen?

The 4 most common attack vectors:

1. Credential stuffing / weak passwords (38% of 2025 breaches) — attackers use previously-leaked passwords to log into other services (people reuse passwords across sites). Defeated by unique passwords + MFA.
2. Phishing (24%) — attackers send emails that trick employees into entering credentials or installing malware. Defeated by phishing training + email filtering + hardware security keys.
3. Vulnerability exploitation (19%) — attackers exploit known vulnerabilities in software (especially unpatched internet-facing servers). Defeated by timely patching + vulnerability scanning.
4. Insider threat (12%) — employees or contractors leak or sell data. Defeated by access controls + audit logs + least privilege.

Less common but growing:

• Supply chain attacks (SolarWinds-style)
• AI-generated phishing (2025 saw a 240% increase)
• Ransomware + extortion (the data is both encrypted AND leaked)

How can I check if I'm affected by a data breach?

Free tools:

1. Have I Been Pwned (HIBP) — the gold standard. Enter your email address and it cross-references 14+ billion breached records. Also offers a "Notify Me" service that emails you when your email appears in a new breach.
2. Google Password Checkup (passwords.google.com) — checks your saved passwords against known breaches. Available in Chrome and Android.
3. Apple Password Monitoring — built into iOS 17+ and macOS Sonoma+. Alerts you if any of your saved passwords appear in known breaches.
4. 1Password Watchtower — paid feature in 1Password that monitors your passwords for breach exposure.
5. Firefox Monitor — Mozilla's free service, powered by HIBP data.
6. Credit monitoring — Experian, Equifax, and TransUnion all offer free credit monitoring that alerts you to new accounts opened in your name.

When to check: At least quarterly, immediately after any breach disclosure, and whenever you receive a breach notification email.

What should I do if I'm affected by a data breach?

Immediate (within 24 hours):

1. Change the password for the breached account. Use a unique password (not used elsewhere).
2. Enable multi-factor authentication (MFA) on the breached account and any other accounts using the same email.
3. Check for suspicious activity — log into the breached account and review recent activity. Look for logins from unfamiliar locations or devices.
4. If financial data was exposed — contact your bank and credit card issuer. Request a new card if your card number was exposed.

Within a week:

5. Freeze your credit at all three bureaus (Equifax, Experian, TransUnion). A credit freeze prevents new accounts from being opened in your name. Free in the US.
6. File an IRS Identity Protection PIN request — if your SSN was exposed, request an IP PIN to prevent tax fraud.
7. Set up fraud alerts with one bureau (it will notify the other two).
8. Review your credit reports at AnnualCreditReport.com (free weekly reports).

Longer-term:

9. Consider identity theft protection — services like LifeLock, Aura, or Identity Guard monitor for SSN misuse. Many breached companies offer 12-24 months of free identity theft protection.
10. Document everything — keep records of the breach notification, your actions, and any fraud that occurs. You'll need this for dispute resolution.

What are your legal rights after a data breach?

United States (varies by state):

• All 50 states have data breach notification laws (you must be notified if your data is exposed)
• California (CCPA/CPRA): right to sue for breaches involving unencrypted data; statutory damages $100-$750 per record
• New York (SHIELD Act): expanded definition of "private information"; increased penalties
• Texas, Illinois, Massachusetts: similar notification requirements + private right of action

European Union (GDPR):

• Breach must be reported to the data protection authority within 72 hours
• Affected individuals must be notified if there's a "high risk" to their rights
• Fines: up to €20M or 4% of global annual revenue (whichever is higher)

United Kingdom (UK GDPR + DPA 2018):

• Similar to EU GDPR post-Brexit
• ICO can fine up to £17.5M or 4% of global annual revenue

Practical advice: File a complaint with your state Attorney General if the breached company is unresponsive. For large breaches, class-action lawsuits often follow — check if you're eligible.

How can you prevent data breaches (for organizations)?

Essential controls:

1. Multi-factor authentication (MFA) on all accounts — would have prevented 60%+ of 2025 breaches
2. Patch management — patch internet-facing systems within 7 days of disclosure
3. Encryption — encrypt data at rest and in transit; use managed encryption keys
4. Least privilege access — limit employee access to only what they need
5. Audit logs — log all access to sensitive data; monitor for anomalies
6. Security awareness training — phishing training quarterly, not annually
7. Vendor risk management — assess and monitor third-party security posture
8. Incident response plan — have a tested breach response plan before you need it

Advanced controls (mature programs):

• Zero Trust architecture
• Privileged Access Management (PAM)
• Data Loss Prevention (DLP)
• Security Information and Event Management (SIEM)
• Regular penetration testing
• Bug bounty programs

How can you protect yourself as an individual?

1. Use unique passwords for every account — a password manager (1Password, Bitwarden, Apple Passwords) makes this trivial
2. Enable MFA everywhere — especially email, banking, social media
3. Check HIBP quarterly — sign up for notifications
4. Freeze your credit — even if you haven't been breached (it's free)
5. Be skeptical of unsolicited emails and texts — phishing is the #1 attack vector
6. Use a VPN on public Wi-Fi — prevents man-in-the-middle attacks
7. Keep software updated — turn on automatic updates
8. Limit what you share on social media — birthdate, pet names, and schools are security question answers

What is the bottom line on data breaches?

A data breach is any incident where confidential data is accessed without authorization. The 8 biggest breaches of 2025 affected 400M+ people, with the Snowflake breach (110M) being the most consequential. To check if you're affected, use Have I Been Pwned — it's free and tracks 14+ billion records. If you're affected: change passwords, enable MFA, freeze your credit, and consider identity theft protection. Prevention is straightforward but requires discipline: unique passwords + MFA + timely patching + employee training. The organizations that follow these basics don't end up in the next breach headline.

---

For related privacy and security topics, see our What is phishing FAQ and our Snowflake data breach analysis.