Data breach
A data breach is when personal information, like a Social Security number or login, is accessed or exposed without permission.
Also called: security breach, data security incident, data leak
A data breach is when personal information, like a Social Security number or login, is accessed or exposed without permission.
What it means
A data breach happens when information that should be private is accessed, taken or exposed without permission. It can come from hackers breaking into a company's systems, an insider taking customer data, or a mistake that leaves information open on the internet. Exposed details often include names, addresses, Social Security numbers, financial account numbers, medical records or login details.
Every state, plus the District of Columbia, Puerto Rico and the Virgin Islands, has a law that requires notification after certain breaches. The rules differ on what data counts, who must be told and how fast. Health plans and most health care providers covered by HIPAA must notify affected people without unreasonable delay. The latest they can wait is 60 days after discovering a breach of unsecured health information.
Breaches often lead to class actions claiming the company failed to protect the data. Settlements commonly pay for documented losses and time spent, and may offer credit monitoring or a cash payment.
What it means for you
A breach notice from a company does not mean you are in a class action, and a class action notice does not mean your data was misused. If a settlement opens, filing directly with the administrator is free, and you can sometimes claim a flat amount without proof. Protect yourself either way. The FTC says a credit freeze costs nothing to place or lift, and an initial fraud alert lasts one year. Keep records of any losses and the time you spend, because many settlements pay for both.
Example
Say a retailer's customer database is hacked, exposing names, emails and card numbers. The retailer mails notices, and several customers sue as a class. A year later, a settlement offers three things: reimbursement for unrepaid fraud charges, pay for time spent, and a choice between credit monitoring and a small cash payment. You check the class definition and deadline, then file on the official settlement website.
FAQ
Check which information was exposed. If it includes your Social Security number or financial account details, consider a credit freeze, which the FTC says is free, or a fraud alert. Review your accounts and credit reports, change passwords, and watch for a settlement you can claim.
It depends on the state and the type of data. For health information covered by HIPAA, notice is due no later than 60 days after the breach is discovered. State laws set their own timing and rules for other kinds of data.
Related terms
- FTC, Data Breach Response: A Guide for Business
- FTC Consumer Advice, Credit Freezes and Fraud Alerts
- 45 CFR § 164.404, notification to individuals of a breach (Cornell LII)
- FTC, Equifax Data Breach Settlement page (example of out-of-pocket and time-spent payments)
Updated Oct 18, 2026. Plain-English definitions for general information — not legal or tax advice.