Most people think about data breaches the way they think about a car accident: something that happens to other people, that you hear about on the news, that doesn't really affect you. Then their inbox starts filling up with targeted phishing emails, or they get a notification from their bank about suspicious login attempts, and suddenly it's very personal.
Understanding what actually happens after a breach — not just "your data was exposed," but the specific chain of events — changes how you think about which email address you hand out and where.
The first 24-72 hours: the breach goes underground
When attackers successfully breach a database, their immediate priority is extraction — getting as much data as possible before being detected. Detection typically happens within days for larger breaches, but smaller breaches can go undetected for months or even years.
Once the data is extracted, it doesn't sit on someone's laptop. It moves almost immediately into underground markets — private Telegram channels, dark web forums, and invitation-only marketplaces where stolen data is bought and sold.
The breach you eventually read about in the news often happened weeks or months earlier. The delay is because companies either don't detect the breach immediately, or detect it and spend time investigating before they're legally required to disclose it.
Real timeline example: The average time between a breach occurring and the company discovering it is 204 days. Then there's typically another 73 days between discovery and containment. By the time you read a headline about a breach, your data may have been in circulation for nearly a year.
What the stolen data looks like
A typical breach database contains email addresses, usernames, and passwords in some form. If the company stored passwords with proper security (bcrypt hashing with strong salts), the passwords are extremely difficult to crack. If they used weaker methods (MD5 hashing, plain text, or weak salts), the passwords can often be cracked within hours using specialized hardware.
Beyond passwords, breach data often includes names, phone numbers, physical addresses, dates of birth, and sometimes payment card details. The richer the dataset, the more valuable it is — and the more targeted the attacks against you can be.
Credential stuffing: the immediate threat
The first thing attackers (or buyers of the breach data) do with working email/password combinations is credential stuffing. This means automatically testing those combinations against hundreds of popular websites: Gmail, Netflix, Amazon, banking apps, PayPal, Spotify.
This works because a significant percentage of people use the same password across multiple accounts. You might have used the same password for a forum you signed up to ten years ago and your email account. If that forum gets breached, your email account is now at risk — even though your email provider was never breached.
We've built systems that interact with authentication APIs, and the volume of credential stuffing attacks visible in login attempt logs is staggering. Major platforms see millions of stuffing attempts per day.
Your email address joins permanent spam lists
Even if your password wasn't exposed or was stored securely, your email address alone has lasting value. Breached email lists get sold to spammers and phishing operators. Your address gets added to lists that circulate indefinitely.
This is why you might start receiving spam from services you've never heard of, years after an incident. Your address was in one list that got sold to another list that got sold to another. There's no expiry date on these lists, and no central registry to opt out of.
How to check if you've been affected
Have I Been Pwned (haveibeenpwned.com) is the most reliable free resource for checking whether your email address appears in known breach datasets. It's operated by Troy Hunt, a respected security researcher, and covers billions of records from thousands of breaches. If your address appears there, treat your associated passwords as compromised — change them and enable two-factor authentication on those accounts.
The structural fix
You can't prevent companies you've trusted with your email from being breached. What you can control is which companies have your real email address in the first place. For services where you don't need long-term access — signups, one-time downloads, trials — using a disposable address means a breach at that service doesn't expose your real email. The breach happens, but you're not in the affected database.
This is especially valuable for lower-trust services: smaller companies with fewer security resources, services based in jurisdictions with weak data protection enforcement, or services you're testing out and might never use again.