Think you’ve been involved in a data breach? This guide will help you find out where and when, and it lists the steps you should take next.

Data breaches are security incidents we now hear about every day. They strike every industry, every sector, and every country. Victims might be individuals, small, independent businesses, non-profits, or large Fortune 500 companies.

Also: The best VPN services right now

IBM estimates that the average cost of a data breach in 2022 for companies was $4.35 million, with 83% of organizations experiencing one or more security incidents.

However, talk of the millions of dollars corporations spend to repair damaged systems, perform cyberforensics, improve defenses, and deal with the legal ramifications of a data breach doesn’t convey the cost felt by individual customers involved — and we’re not talking just financially.

Also: How to delete yourself from internet search results and hide your identity online

For individuals, the costs can be more personal. And while financial damage may be a factor, individual victims may face targeted phishing campaigns, social engineering schemes, or identity theft.

Here’s how data breaches occur, how they can impact you, and what you can do in the aftermath.

How to find out if you’ve been involved in a data breach

How do data breaches happen?

According to IBM, the most common initial attack vector cyberattackers use to break into a company’s network is the use of compromised credentials.

Also: How to find out if an AirTag is tracking you

These credentials can include account usernames and passwords leaked online, stolen in a separate security incident, or obtained through brute-force attacks, in which automatic scripts try out different combinations to crack easy-to-guess passwords.

Other potential attack methods are:

• Magecart attacks: Companies like British Airways and Ticketmaster have experienced these assaults, in which malicious code is quietly injected into e-commerce payment pages to harvest your payment card information.

• Malicious code injected into website domains and forms: The same tactics can be used to grab other forms of data from customers and visitors, with data stolen directly from unaware victims visiting a legitimate service.

• Business Email Compromise (BEC) scams: BEC scams require an attacker to pretend to be a company employee, contractor, or service provider. They latch on to email threads or contact a staff member — such as one working in the payments or customer service departments — to trick them into handing over information or paying an invoice to the wrong bank account.

• Insider threats: Sometimes employees have axes to grind, or they are made an offer by cybercriminals that they don’t refuse. This can lead to your information changing hands, such as in the case of a Russian national arrested for trying to recruit US company workers to install malware on their employer’s network.

• Negligence: Unsecured servers, left open and exposed online likely due to misconfigurations, are a principal reason for data exposure and breaches. Information may also be leaked accidentally by employees.

• Falling for spam and phishing attempts: On an individual level, cybercriminals will try and get you to part with your PII and account information through spam emails, phishing domains, and more.

How do data breaches impact you?

If you’ve been involved in a data breach as a user or customer, your records may have also been exposed, stolen, or leaked online.

Your personally identifiable information (PII), including your name, physical address, email address, work history, telephone number, gender, and copies of documents including passports and driving licenses, can all be used to conduct identity theft.

Also: How to find and remove spyware from your phone

ID theft is when someone uses your information without permission to pretend to be you. They may use your identity or financial data to conduct fraud and commit crimes. This can include tax-related fraud, opening up lines of credit and loans in your name, medical fraud, and making fraudulent purchases online.

Criminals may also ring up a company you use, such as a telecoms provider, and pretend to be you to dupe customer representatives into revealing information or making changes to a service, such as in the case of SIM-swapping attacks.

These scenarios can impact your credit score, make you financially responsible for a loan or payment you didn’t agree to, and lead to serious stress and anxiety in cleaning up your name and finances. As cybercrime is global, it can also be extremely difficult for law enforcement to prosecute the perpetrators.

Also: How to protect and secure your password manager

Blackmail, too, can be a factor. When extramarital affairs website Ashley Madison experienced a data breach in 2015, some users were contacted by cybercriminals threatening to tell their partners, friends, and colleagues about their activities unless they were paid.

What happens when an attacker is inside a network?

The attacker may conduct surveillance first, mapping a network to work out where the most valuable resources are — or to discover potential pathways to jump into other systems.

Also: FBI warns of public ‘juice jacking’ charging stations. How to stay protected

The majority of data breaches are financially motivated. Attackers may deploy ransomware to blackmail their victims into paying up to regain their access to the network. In so-called “double-extortion” tactics, hacking groups may first steal confidential information and then threaten to leak it online.

Alternatively, some may grab and go, stealing the intellectual property they came for and then erasing their tracks. Others may test their access point and sell it to other cyberattackers via the dark web.

Also: How to use Tor browser (and why you should)

In some cases, network intrusions are for one reason alone: to disrupt services and damage a company.

Some miscreants download data and make these data dumps freely available online, posting them to resources such as Pastebin.

What is the dark web?

The internet as a system can be divided into three layers: the clear, the deep, and the dark web.

• The clear web: The clear web is the internet most of us use on a daily basis. Millions of websites and pages are indexed by search engines, and you can access them from a typical browser, such as Safari, Chrome, or Firefox.

• The deep web: The deep web is the layer underneath, which requires a specific browser to access. The Tor network and a VPN are typically required. Websites are indexed using .onion addresses, and the entire network is based on the principles of security and anonymity. This helps in legal applications — such as circumventing censorship — as well as illegal operations.

• The dark web: The dark web is the next layer down and is an area that is associated with criminal activity. This can include the sale of information, illegal products, drugs, weapons, and other illicit material.

The terms dark and deep web can be used interchangeably.

Also: Your guide to the dark web and how to safely access .onion websites

In this world, data is cheap and unnecessarily collected in bulk by companies that don’t protect it effectively or govern themselves in data collection practices well. When a breach occurs, you are most often just offered a year or so of free credit monitoring.

Unfortunately, it is up to individuals to deal with the fallout, and knowing you’ve been involved in a data breach is half the battle. Protecting yourself by maintaining adequate account security, changing your passwords frequently, and being on alert for suspicious activities are ways you can mitigate the damage these frequent security incidents can cause.