Data Breaches and What Actually Follows

Your data has been in a breach. Probably several. The useful question isn't how to prevent that — it's which exposures actually matter and what each one warrants.

Last verified 2026-07-25

Triage by what was actually exposed

Breach notifications all sound equally alarming, and the exposures behind them differ enormously in consequence.

An email address alone mostly means more phishing. A password means every account where you reused it is now exposed — which is the real reason password reuse is the dangerous habit, not password complexity. Card numbers are bounded: cards get reissued and dispute rights apply.

The exposure is automated, which is why reuse matters so much. Credential stuffing is attackers taking breached username and password pairs and replaying them against hundreds of other sites in bulk, on the assumption that some fraction of people used the same pair twice. Nobody is targeting you specifically; the software just tries everything.

A Social Security number is the serious one. It doesn't expire, can't be reissued in any practical sense, and is the key input for opening credit in your name. That's the exposure that warrants a freeze.

Credit monitoring is a smoke alarm, not a lock

Breached companies routinely offer a year of free credit monitoring. It's worth accepting, and it's worth being precise about what it does.

Monitoring notifies you after something appears on your file. It detects. A freeze blocks the account from being opened in the first place. It prevents. The free offer is the weaker of the two tools, and the stronger one is also free.

Twelve months of monitoring is also a mismatch for the threat: a stolen Social Security number is useful to a criminal indefinitely, and is sometimes deliberately used long after the news cycle ends.

Neither tool covers everything. Buy Now, Pay Later — short-term instalment credit offered at checkout — is a case worth knowing about, because these lenders don't all pull or report to the credit bureaus the way a card issuer does. Where they don't, a freeze may not block the account and monitoring may not surface it, and the dispute rights differ from a credit card's.