• Data breaches often aren’t your fault. Your personal information can leak from companies you never chose, so the goal is limiting the damage.
• Stolen credentials are the top way in. A password manager and MFA or passkeys, starting with your main email, make stolen data worthless.
• A credit freeze stops many identity theft scams. It’s free with Equifax, Experian and TransUnion and blocks most new accounts in your name.

In part three of our Cybersecurity Awareness blog series, we discussed how smart devices at home collect your data and the simple settings that put you back in control. In part four, we will discuss what happens when your personal information ends up in a data breach and the habits that make stolen data far less useful to criminals.

Your birthday is not a password and your dog’s name deserves a break

You can change a password. Changing your birthday, family history or Social Security number is considerably less convenient. That is why protecting personal information takes more than waiting for a breach notice and choosing a new variation of the dog’s name.

You can do everything right and still end up in a breach

A data breach is any incident where information is exposed or someone gains access they shouldn’t have. Most breaches happen at an organization that held your information, such as a retailer, a ticketing site or a data company you have never heard of. You can use strong, unique passwords everywhere and still find your name, email address and phone number in a stolen database, because the leak happened on someone else’s systems.

Some of those organizations aren’t ones you chose. National Public Data, a background-check company, compiled personal records from public and commercial sources. In April 2024, a criminal group listed what it said were 2.9 billion of those records on a hacking forum for $3.5 million. The records included names, addresses, dates of birth, phone numbers and Social Security numbers. By August, a version of the data had been posted online for free. The company first reported about 1.3 million affected people, but its later bankruptcy filing acknowledged that hundreds of millions might be. (The 2.9 billion figure counts records, not people. Each past address can create a separate row.)

Even customers who were careful with their own passwords can be swept up. In 2023, attackers logged in to about 14,000 accounts at the genetic-testing company 23andMe using passwords that customers had reused from other breached sites. Through a feature that links relatives to one another, the attackers then reached profile information for roughly 6.9 million people, most of whom had done nothing wrong. Samples of the stolen data soon appeared for sale on a hacking forum.

You control your own habits, not every company’s security. That’s exactly why the habits later in this article focus on making stolen data less useful.

Where stolen data goes: a marketplace with price lists

That forum listing is not unusual. Stolen personal data really is bought and sold like a commodity, with suppliers, middlemen, price lists and bulk deals. Much of this trade is linked to the “dark web,” a term that often gets confused with others:

• The surface web is anything a search engine can find.
• The deep web is everything behind a login or otherwise hidden from search engines, such as your inbox, your bank account and our company intranet. Almost all of it is perfectly ordinary.
• The dark web is a small corner of the internet reachable only with special software, most commonly Tor, which hides who and where users are. Journalists and people living under censorship rely on it, but it also makes a convenient storefront for criminals.

A lot of this trade also happens on invitation-only forums and encrypted messaging channels such as Telegram, so “the dark web” is really shorthand for an underground economy. Stolen data usually moves through four stages:

• Steal. Attackers break into an organization’s database, or they infect individual computers with infostealers: malware (harmful software) that quietly collects saved passwords, browser cookies and autofill data. Infostealers often hide in pirated software, fake browser updates and malicious ads.
• Sell. Data is listed on criminal forums or automated shops. One infected computer’s haul can go for a few dollars; a large database can be priced in the hundreds of thousands or more. Initial access brokers sift through stolen logins for ones that open company networks, then resell that access to ransomware gangs.
• Combine. Buyers merge many breaches into huge combolists of email and password pairs, then fill out profiles with information from data brokers, companies that collect and sell personal details, often legally.
• Use. End buyers put the data to work through credential stuffing (automatically trying leaked email and password pairs on hundreds of other sites), scam messages, account takeovers and identity fraud.

Ticketmaster customers saw the “sell” stage up close in May 2024, when a group posted what it said were records for 560 million of them on a hacking forum with a $500,000 price tag. Ticketmaster’s parent company confirmed unauthorized activity in a third-party cloud database.

The market can also be dismantled. Genesis Market sold bundles of data stolen from more than 1.5 million infected computers, covering over 80 million accounts. Buyers received a custom browser that let them pose as victims by replaying their cookies, the small files that tell a website you’re already signed in. In April 2023, the FBI and Dutch police led an international takedown, nicknamed “Operation Cookie Monster,” that resulted in more than 100 arrests. Two years later, Microsoft, the U.S. Department of Justice, Europol and Japanese authorities disrupted the Lumma infostealer. Lumma had infected more than 394,000 Windows computers in just two months, and the takedown blocked or seized about 2,300 web domains that powered it.

Behind all of this activity sits one finding from Verizon’s 2025 Data Breach Investigations Report:

Stolen credentials were the single most common way attackers got in.

That’s good news for us, because credentials are the part we can protect. Stolen data is valuable only when it still works. Every unique password, every second sign-in check and every frozen credit file makes what criminals bought worth less.

Protect the account that opens the other accounts

Start with your main personal email. It receives password resets for banking, shopping and almost everything else, so whoever controls it can unlock the rest. Use a password manager, an app that creates and remembers a strong, different password for every site, so the only one you need to memorize is the one that opens the manager. Reusing one password is like giving every building the same key and hoping nobody notices. It’s also exactly what credential stuffing counts on.

Turn on multifactor authentication, or MFA, which adds a second check beyond your password. Choose passkeys or hardware security keys where they’re offered. A passkey replaces your password with a cryptographic key stored on your phone or computer and unlocked with your fingerprint, face or PIN. A security key is a small USB or wireless device that does the same job. Both work only on the genuine site, so a fake sign-in page can’t fool them. Otherwise, an authenticator app is a good choice, and text-message codes still beat a password alone. Store recovery codes safely, and confirm that the backup email and phone number on each account are yours.

Never approve a sign-in prompt you didn’t start. Attackers sometimes send repeated prompts, hoping you’ll tap “approve” just to make them stop, a trick called MFA fatigue. Never share a one-time code with someone who calls or messages you. Keep your browser and devices updated, and skip “free” cracked versions of paid software, a favorite hiding place for infostealers.

Make identity theft harder before it happens

Your credit report is the record lenders check before opening an account in your name. In the United States, three bureaus keep these reports: Equifax, Experian and TransUnion. A credit freeze blocks most access to your report, which stops many attempts to open new accounts in your name, even by someone holding your Social Security number. It’s free by law. Set it up with each bureau through its official site, save the login details, and lift it temporarily when you apply for credit yourself.

A freeze doesn’t stop misuse of cards you already have, so turn on transaction alerts and review your statements. Check your credit reports through AnnualCreditReport.com, the official source linked in Federal Trade Commission (FTC) guidance. A paid “credit lock” product is not the same as the free freeze.

Check for exposure without creating a new exposure

Have I Been Pwned is a free service that security researcher Troy Hunt created in 2013. It shows whether an email address appears in known breaches and can alert you when it turns up in new ones. It tracks well over 15 billion breached accounts, including data from infostealer logs. “Pwned” is Internet slang for compromised, because apparently plain English was unavailable that afternoon.

If your address shows up, you’re in good company; most people’s does. Treat each result as a to-do list. Open each breach to see what data was exposed. If passwords were involved, change that password everywhere you used it. If only contact details leaked, expect more convincing scam messages. A result doesn’t necessarily mean your current password was stolen, and a clean result doesn’t prove you are safe. Many password managers and browsers can also check your saved passwords against breach lists without sending the passwords themselves, so turn that on if yours offers it.

Type a trusted service’s official address yourself instead of clicking a “your data is on the dark web” message, which is a popular scam opener of its own. Never give a password to an unfamiliar “checker.” Dark web monitoring services can flag some exposures, but none can see every private sale or stolen copy.

Removal is worth doing even when it is imperfect

People-search sites are data brokers that publish profiles listing names, addresses, relatives and phone numbers. Search for your name along with your city, employer and usernames you commonly use, and request removal through each site’s official opt-out process. Save the confirmation and check back after a few months, because listings can reappear. Public records will remain, and your details may still show up in relatives’ listings. Deletion is useful maintenance, not a witness-protection program.

Paid removal services can save time. Compare coverage, yearly cost and how often they recheck, and don’t hand over more sensitive information than the job requires. Eligible California residents can use DROP, the state’s Delete Request and Opt-out Platform, to ask every registered data broker to delete their information at once. Brokers began processing those requests on August 1, 2026. It isn’t instant, and exceptions apply. Elsewhere, check your local rights to access, correct or delete your data, and keep records of responses.

A familiar detail is not an identity check

This is where the underground marketplace meets your inbox. Suppose a caller knows your manager’s name, your address and your recent trip. That may show research, not legitimacy, because breaches, data brokers and public posts can all supply those details.

For any request involving money, logins or urgent access, verify it through a phone number, app or contact you already trust, not one supplied in the message. For a supposed family emergency, call the person back on a number you know, and consider agreeing on a family verification phrase. Voice-cloning and video tools can now imitate people convincingly, so a familiar voice or face isn’t proof on its own. Technology has made impersonation easier, but impatience still does much of the heavy lifting.

At work, follow the established approval process even when the sender appears senior. Report suspicious messages through the usual channel, especially if you’ve already clicked or shared something. Reporting quickly gives IT more options; quietly hoping the problem develops better manners does not.

If information has already escaped

If a password was exposed, change it and every reused copy from a device you trust. Sign out of other active sessions, check your recovery details and remove unfamiliar connected apps. If a work account or device might be compromised, bring in IT, because a password change may not remove malicious software.

If your identity details are misused, contact the affected financial institutions and use IdentityTheft.gov for a step-by-step recovery plan. Keep messages, transaction records and screenshots. If stalking or threats involve your address or location, put your safety first and get help, because ordinary privacy housekeeping may not be enough.

No one has a complete map of where their information has gone. The goal is to reduce what gets collected, watch for signals you can act on, and limit the damage from what you can’t take back. Employers have a part to play too, by collecting less, restricting access and providing approved tools. Employees shouldn’t need a private investigator on retainer to have a normal working day.

Try this today: secure your main email, look yourself up on Have I Been Pwned and set aside fifteen minutes to freeze your credit. Knowing your birthday should earn someone a chance to buy you cake, not permission to open a credit card.

Sources and answers to common questions

Selected bibliography and practical reading. Sources reviewed October 9, 2026. Follow official instructions for your device and region; settings and policies can change.

What should I do about a breach?

Have I Been Pwned. Frequently Asked Questions

Explains exposed data, notifications and why a negative result doesn’t establish safety.

How common is credential theft?

Verizon. Data Breach Investigations Report

Annual analysis of how breaches happen, including the role of stolen credentials and infostealers.

What happened with National Public Data?

NBC News. 2.9 billion data records may have been exposed

The Record. National Public Data files for bankruptcy

What was exposed, how it was offered for sale, and the company’s later acknowledgment of the scale.

What happened with 23andMe?

BleepingComputer. 23andMe data breach: hackers stole raw genotype data, health reports

How reused passwords on about 14,000 accounts exposed information on millions of people.

What happened with Ticketmaster?

CyberScoop. Alleged Ticketmaster breach could be part of larger compromise

The forum listing, the company’s confirmation and the cloud-database connection.

What was Genesis Market?

CNBC. Genesis Market shut by law enforcement in cybercrime operation

How a marketplace for stolen logins and browser cookies operated, and how it was taken down.

How was the Lumma infostealer disrupted?

Microsoft. Disrupting Lumma Stealer

How infostealer malware spreads and the 2025 international action against it.

How do I strengthen sign-ins?

CISA. Secure Our World awareness resources

Official guidance on passwords, MFA, phishing and updates.

Why prefer passkeys or security keys?

CISA. More than a Password

Explains phishing-resistant authentication and alternatives.

How do I freeze credit and review reports?

FTC Consumer Advice. Credit Freezes and Fraud Alerts

Freezes versus alerts, official bureau contacts and credit-report resources.

How do people-search opt-outs work?

FTC Consumer Advice. What To Know About People Search Sites That Sell Your Information

Do-it-yourself and paid removal options, identity verification and limitations.

Can I submit one broker deletion request?

CalPrivacy. Delete Request and Opt-out Platform

Eligibility, request process and limitations for California residents.

How do I recover from identity theft?

FTC. IdentityTheft.gov

Official reporting and a tailored recovery plan. Go to the site directly rather than following links in unsolicited messages.