What is a Data Breach and How Can You Protect Yourself Against One?

Every time you make a purchase, whether that’s in person, from an app, or from your favorite online store, you’re exchanging your personal information for that good or service. You may do everything right when it comes to practicing good online personal safety, but you can’t always guarantee that the business you bought from does the same. Companies collect and store a great deal of information about you — most of which you’ve likely shared willingly — and if those businesses are targeted by hackers, it is possible you may become a victim through no fault of your own.

The convenience of storing and sharing so much personal data online comes with risks, as bad actors can access and steal personal information from any business or organization that you’ve interacted with, leaving consumers vulnerable to financial loss and identity theft. When information is compromised, leaked, or stolen from a company, this is known as a corporate data breach. 

Fortunately, there are steps you can proactively take to safeguard yourself from data breaches and protect your privacy and identity. In this blog, you’ll learn how data breaches happen, what can happen with stolen data, and the best tips for data breach protection.

‍

What is a data breach?

A data breach is an incident in which a group or individual gains unauthorized access to private, protected, confidential, or sensitive information. These cyber criminals may target individuals or organizations. The attack can be as simple as stealing a password to log into a single account or as extensive as obtaining the credit card numbers of millions of consumers. Cyber criminals primarily use data breaches for financial gain, selling to third parties, opening new accounts, using credit cards, and withdrawing funds from bank accounts.

‍

How does a data breach happen?

Generally, data breaches occur due to a vulnerability within an organization’s system, an individual attack, or an error by an employee. Here’s how most data breaches happen.

• Cyber attacks: These are targeted attacks that often use malware to steal or gain unauthorized access to personal information. There are many techniques attackers may use to gain unauthorized access to a corporation’s data, including ransomware or phishing attempts, in which case attackers pose as a trusted entity and trick victims into sharing sensitive data, opening malicious links, or downloading a virus.
• Theft or loss of assets: Sometimes, the unauthorized acquisition of data can happen from physical theft. Examples include the theft or loss of a company laptop, mobile device, hard drive, or login credentials written on a sticky note. These devices are often unencrypted or even left unlocked, but knowledgeable cyber criminals may also be able to hack into protected devices.
• Malicious insider: An employee selling or leaking information is a data breach. They might leak confidential information to a competitor or hacker to hurt the company, damage the reputation of an individual, or make a profit. 

‍

What can happen after a data breach?

What an attacker does with the data obtained from a breach can vary based on the type of sensitive information they obtain. The theft of personally identifiable information (PII), such as names, addresses, phone numbers, banking information and Social Security numbers (SSNs), can pose risks to individuals, including identity theft. For example, with a few pieces of personal information, attackers can open new credit cards, take out loans, apply for tax refunds and government aid, and more.

When a data breach occurs, it can also take time for a company to identify and notify customers about the breach. On average it takes companies 277 days from the time of the breach to the time they are able to disclose the breach to customers. In some cases, companies will send a notice in the mail to customers who are impacted by a corporate data breach and offer identity monitoring services to help customers protect their personal information that was leaked as part of the breach. 

‍

Biggest recent data breaches

A multitude of organizations have suffered data breaches in recent years, exposing billions of records that put customers’ information at risk. 

T-Mobile data breach: In January 2023, the U.S. wireless carrier T-Mobile announced it was investigating a data breach involving 37 million postpaid and prepaid accounts. T-Mobile revealed that the attacker started stealing data around November 25, 2022. The mobile carrier reportedly detected the malicious activity on January 5, 2023, and cut off the attacker's access to the API one day later. Basic customer information including names, billing addresses, email addresses, and phone numbers were compromised. 

Twitter data breach: In January 2023, sources reported that starting in July 2022, threat actors and data breach collectors had stolen and circulated large data sets of scraped Twitter user profiles containing both private information like phone numbers and email addresses and public data on various online hacker forums and cyber crime marketplaces. An estimated 200 million accounts were compromised.

Uber data breach: In November 2021, it was confirmed that popular ride-sharing app Uber was breached, compromising the personal details of over 57 million rider and driver accounts including names, drivers license numbers, email addresses, and mobile phone numbers. Uber also suffered a second data breach in November 2022 targeting internal corporate data and credentials, the leaked information included source code, IT asset management reports, data destruction reports, Windows domain login names and email addresses, and other corporate information.

LastPass data breach: in August 2022 it was confirmed that popular password manager company LastPass suffered a data breach, exposing customer’s passwords and credentials. The initial breach ended up allowing the unauthorized party to access sensitive user account data as well as vault data. 

WhatsApp data breach: In November 2022, a post on a well-known hacking community forum claimed almost half a billion WhatsApp records had been breached and were up for sale. The post, which multiple sources confirmed was true, claimed to be selling an up-to-date 2022 database of 487 million mobile numbers used on WhatsApp, which contains data from 84 countries.

‍

How can you protect yourself from a data breach?

A data breach can happen to any organization, so it’s wise to be proactive and safeguard your personal information and data. Luckily, you don’t need to be a tech genius to protect yourself from cyber crimes and prevent identity theft. Follow these strategies and best practices to keep your information safe following a data breach.

• Use strong passwords: Create unique and secure passwords for every account, using upper and lower case letters, numbers, and symbols. Don’t use words or sequences that are easy to guess, such as “password” or “1234,” or personal details like your child’s name. If you’re worried about losing or forgetting your passwords, download a trusted password manager. Password manager apps can help you generate strong passwords and autofill them when you log in.
• Enable multi-factor authentication (MFA): Most websites now give the option to enable multi-factor (or two-factor) authentication when you log in. Even if you have complex passwords, using MFA adds an extra layer of security. MFA is a multi-step account login process that requires users to enter more information than just a password. MFA can help prevent unauthorized users from logging into your account, even if they have your password.
• Check credit reports: Review your credit report regularly to ensure no new loans or credit cards were fraudulently opened in your name. Each major credit bureau — Equifax, Experian, and TransUnion — allows consumers to generate one free credit report each year. You may request them together or separately at any time. Getting one credit report from a different reporting agency every four months is a good way to monitor your credit throughout the year. You can also sign up for free credit monitoring from a bureau or separate service.
• Monitor transactions: Check your transactions, bank accounts, and financial account statements frequently. Make sure you have fraud alerts set up. These services notify consumers of suspicious transactions or activity on their accounts.
• Prevent identity theft: Digital security and identity theft protection services, like Lookout Life, monitor your important information and alert you about breaches and suspicious activity. They also include services such as antivirus and anti-malware security, social media monitoring, and text message and online scam protection. In the event of a data breach, Lookout offers expert support and identity theft insurance.
• Practice caution: Be extra cautious when clicking links or downloading files online. Many scams occur when cyber criminals pose as trusted individuals or organizations, such as friends, family, banks, or the government. If you receive a link or file you weren’t expecting, contact the organization, friend, or family member directly to ensure the message is legitimate.
• Update software: Keep software up to date to avoid vulnerability exploits and turn on automatic software updates when available.
• Watch for data breaches: The Identity Theft Resource Center (ITRC) is a non-profit organization that seeks to educate consumers about identity crimes while providing protection and assistance to victims. When you sign up for their free data breach alert service, you can create a list of companies that store your personal information. ITRC will notify you via email if one of these organizations has suffered a data breach. Lookout Life provides data breach monitoring and alerts when a company, app, or service you use experiences a leak.
• Create backups: Physical theft and viruses can lead to the corruption, deletion, or loss of critical data. Backup your important data to ensure you can restore access in case of a data breach. You can use USB drives, cloud storage services, or an external hard drive.

‍

Data breach recovery process

If your personal data is compromised in a security breach, it is recommended to take action immediately. The following steps can help you avoid identity theft and protect your finances.

1. Determine the details of the breach: What data was leaked or accessed? This information will determine your next steps. Cyber criminals stealing social media logins pose a much different risk than leaked financial information or a Social Security number, for instance.
2. Freeze your credit: A freeze prevents creditors from accessing your credit reports, which will stop identity thieves from opening new accounts. Freezing is free, and it does not affect your credit score. You can freeze and unfreeze your credit with Experian, TransUnion, and Equifax at any time.
3. Check your credit report: Request your credit reports and carefully inspect them for suspicious inquiries, new accounts you didn’t open, and other irregularities. Add fraud alerts to your accounts if you’ve already requested a credit report in the past 12 months. This alert warns creditors to verify your identity before issuing loans or credit and allows you an additional three free credit reports.
4. Call financial institutions: Contact your bank and/or credit card issuer. They will recommend the next best steps, such as canceling or disputing suspicious charges, requesting a new card, or changing account numbers.
5. Change passwords: If attackers seized your login credentials in the data breach, change and strengthen your passwords as soon as possible. Never use the same password for more than one account.

‍

Learn more and stay safe with Lookout

To help customers stay ahead of risks that emerge in the aftermath of data breaches, Lookout offers advanced protection to guard against online scams and fraud.

Lookout’s app goes beyond basic security and antivirus functions, and proactively identifies and blocks sophisticated threats  to your personal data, so you don’t have to worry. For example, if a data breach occurs, you will be notified instantly with details about the breach and Lookout will continuously monitor your important identity and financial information for any signs of compromise or theft. From monitoring SSNs and credit card information online, to defending against scams and phishing attacks that can emerge after a data leak, Lookout makes data breach protection easy and convenient.

‍

FAQs

What is a data breach?

A data breach is an event that leads to the unauthorized access, loss, destruction, or disclosure of sensitive or personal information. The cause may be accidental or intentional.

What can you do to protect yourself from data breaches?

Data breach prevention starts with strong passwords. Make unique passwords for every account, and change your passwords every few months. Choose multi-factor authentication, which prompts users to enter a code sent by text, email, or phone call after entering their password. 

What is an example of a data breach?

A data breach may involve a cyber criminal gaining unauthorized access to accounts, laptops, or networks through malicious means like malware, or the theft or loss of a mobile device or private document.