What Happens If I Get Breached?

May 27, 2025

We all have a fear—or at least know of someone with a fear—of getting breached. And chances are, you yourself have been, or at the very least, know someone who has. But what is a breach, really? What actually happens when you or someone close to you becomes the victim of one?

A data breach occurs when unauthorized individuals gain access to sensitive information—like login credentials, personal data, financial info, or private communications. These breaches can happen through phishing, malware, weak passwords, or exploiting security vulnerabilities. Once inside, attackers may steal, copy, sell, or leak your data—often on places like the dark web. The consequences can range from identity theft to financial fraud to long-term reputational damage.

The sense of violation people feel after a breach is real—and often overwhelming. What follows is a quick personal story of someone who experienced this firsthand: an acquaintance trying to make sense of a data breach that impacted his family.

I had an old coworker reach out to me a while ago. One of her current coworkers had recently experienced a breach for one of his loved ones and asked if it was okay for her to give him my contact information so we could talk about the options.

When we hopped on a call, he informed me that his daughter had been breached and given away her various credentials for both her bank, social media, and email. He knew vaguely about what was happening – he knew that the information stolen would probably be sold on the darknet, and wanted to know what he could do as a father: “Should I get a copy of tails up and running? Am I able to find the data that was stolen?” Tails is a flavor of linux with anonymity as a focus. “How do I even approach this? Where do I get started with the dark web?”

I let him know that he could get a tor browser and start browsing around but warned him that that’s problematic for a couple of reasons, one just being your own mental state depending on some of the things one could stumble across when searching on the dark web.

He was just at such an utter loss and unsure of what to do with the complete sense of violation that he was feeling. He did have some technical abilities as he’d been a software engineer. So I explained to him the process of some of these operations.

Even if he did learn the technologies required to browse the darknet safely, which is a non-trivial task, he’d still need to know where to go, which in itself is information that is shielded. Even if he were able to do that, and find sites where stolen data is being brokered, the chances of finding his daughter’s data are very slim. While it’s true that some hackers will post the entirety of their breaches for cred, organizations that do this as a business will generally post a subset of the data they steal as a sample to entice buyers. The chances of his daughters information being in that sample are slim. But let’s say that happens to be the case. If that was the case, would he be attempting to purchase the data? Firstly, that’s very illegal, but also, there are no guarantees that they won’t sell it to multiple people anyway. On top of that, if his daughter’s data was posted as a sample, it’s out there to everyone that can see it now anyway.

All this to say once it’s out there, it’s better to just assume it’s out there. With the major breaches of companies with millions of users that have been happening for years, it is safe to say that plenty of our data is already out there – yours and mind. It’s just the world we live in.

What Can You Actually Do After a Breach?

I gently told him that diving into the dark web in search of his daughter’s stolen data wasn’t just risky and likely futile—it also wouldn’t change the outcome. Once data is out there, it’s essentially impossible to retrieve or erase. In most cases, the better path forward is not chasing what’s already lost but protecting what remains.

If you or someone you know has been breached, here’s what you can and should do immediately:

Freeze or close any compromised accounts (banking, email, social media, etc).

Change all passwords—not just the affected ones.

Enable two-factor authentication everywhere possible.

Monitor financial accounts and credit reports for unusual activity.

And most importantly, take this as a chance to build long-term security habits. Teach your kids, friends, and coworkers to:

Use a different password for every site.

Regularly update passwords, even if there’s no sign of compromise.

Think twice before sharing information, especially in response to unexpected emails, texts, or calls.

The best thing we can do in a world where breaches are increasingly common is stay vigilant, proactive, and prepared—not paralyzed by what’s already been lost. ll do is keep a posture of vigilance, instead of attempting to recover what’s been lost.