What if some of my information was exposed too?

We use our email addresses to create accounts, our phone numbers to verify them, our personal information to sign up for services, and sometimes even upload identity documents. We share pieces of our lives with dozens, sometimes hundreds, of online services.

So when we hear about a data breach, it's easy to think:

"That happened to a company. What does it have to do with me?"

Actually, quite a lot.

And that question is really where this article starts. Not with the news itself, but with what it made me want to find out about my own digital identity, and how much of it is actually under my control.

First, What Exactly Is "Our Data"?

When we hear the word data, we often imagine something technical. But our everyday digital life is full of it, in ways we rarely stop to list out.

Personal information

• Your name

• Date of birth

• Phone number

• Email address

• Home address

• Workplace or college

Account information

• Usernames

• Passwords

• Recovery email addresses

• Recovery phone numbers

• Security questions

• Login sessions

Financial information

• Bank account details

• Card information

• Payment history

• Transaction details

Identity information

• Government ID numbers

• Passport information

• Driver's license

• Identity documents

• Photos of official documents

Digital information

• Photos

• Messages

• Files

• Location information

• Search history

• Contacts

• General online activity

Individually, some of these details may not seem very dangerous. The real problem shows up when multiple pieces get combined.

Name, phone number, email, workplace, and one old password, strung together, tell an attacker far more about a person than any single piece ever could.

This is why protecting personal data isn't only about protecting your password. It's about protecting your digital identity.

How Does Our Data Get Exposed?

There isn't just one way.

Sometimes the problem is a company we trusted. Sometimes it's our own password. Sometimes it's simply a convincing message that catches us at the wrong moment.

Here are the common paths.

1. A Company Gets Breached

Imagine you create an account on a website. You provide your name, email address, and phone number, trusting the company to protect that information. But if the company's systems are compromised, some of that information could be exposed.

This is one uncomfortable reality of living online: we don't control every system that stores our information.

That doesn't mean we should stop using online services. It means we should understand that security is a shared responsibility, not something we can fully guarantee on our own.

2. Phishing

You receive a message:

"Your account will be permanently locked today. Verify your identity immediately."

There's a link. You click it. The website looks almost identical to the real one. You enter your username and password, and just like that, you've handed your credentials to an attacker.

This is phishing, and it doesn't always look like a badly written email anymore. Messages can be convincing, personalized, and urgent.

That's why one of the most useful habits you can build is simple:

Don't let urgency make the decision for you.

CISA recommends recognizing and reporting phishing, using strong passwords, enabling MFA, and keeping software updated as core online-safety habits.

3. Reusing the Same Password

This is one of the easiest mistakes to make.

Suppose you use MyPassword123 for five different websites. One of those websites gets breached, and an attacker now has your password.

They may try the same username and password combination on other popular services. This is called credential stuffing.

The problem isn't necessarily that your other accounts were hacked directly.

The problem is that you gave them the same key.

That's why:

"One account, one unique password"

is such an important rule to actually live by, not just know about.

4. Malicious Apps and Software

Another route is the device itself.

Installing applications from unknown sources, downloading pirated software, opening malicious attachments, or ignoring security updates can all increase the risk of malware compromising a device.

Once an attacker gets access to a device, the problem can become much bigger than a single password.

They may be able to access:

• Files

• Browser sessions

• Saved credentials

• Other sensitive information

Keeping software updated is one of the basic protections recommended by CISA, because updates often include fixes for exactly this kind of vulnerability.

5. Social Engineering

Sometimes attackers don't need to "hack" a system at all.

They manipulate a person instead, pretending to be:

• A bank employee

• A company representative

• A government official

• A colleague

• A delivery service

• Technical support

The goal is to convince someone to reveal information or perform an action.

This matters because even strong technical security can be undermined if a person is successfully manipulated into opening the door themselves.

So, What Is the Dark Web?

The phrase "dark web" often makes it sound like there's one secret website where all stolen information is stored.

That's not really how it works.

The dark web is a part of the internet that isn't normally accessible through standard web browsing.

Some legitimate uses exist, but cybercriminals can also use:

• Hidden services

• Forums

• Marketplaces

to:

• Communicate

• Trade stolen information

• Advertise illegal services

• Distribute data

There's an important distinction worth holding onto here:

A data breach does not automatically mean your information is currently being sold on the dark web.

And:

Finding an email address in a breach database doesn't prove that information is currently being traded there either.

This distinction matters because cybersecurity should be based on evidence, not fear.

The Question We Should Actually Ask

It's tempting to ask:

"How do I make sure my data can never be stolen?"

Unfortunately, there's no perfect answer.

Even a careful person can be affected by a breach at a company they use.

So I think a better question is:

How can I reduce my risk and detect problems early?

That reframing changes cybersecurity from something frightening into something practical.

Think of your digital life like your house.

You don't install one lock and assume you're completely safe. You might have:

• A strong front-door lock

• Windows that close properly

• An alarm

• Security cameras

• Good lighting

• General awareness of anything suspicious

Digital security follows a similar idea: one protection shouldn't have to do all the work. It works best in layers.

Step 1: Start With Your Most Important Account, Your Email

If I had to tell a beginner to secure only one account first, I'd start with their primary email.

Why?

Because email is often connected to everything else.

Forgot your social media password?

A reset link may go to your email.

Forgot your shopping account password?

Again, email.

Need to recover another account?

Your email may be involved.

Protecting your email is like protecting the front door to your entire digital life.

Start with:

• A unique password

• MFA or a passkey

• Updated recovery information

• Recovery codes stored somewhere safe

• Login alerts

• Regular checks of logged-in devices and sessions

Step 2: Stop Reusing Passwords

Let's talk about passwords without making them unnecessarily complicated.

A common idea is:

"I'll just replace A with @ and O with 0."

Turning:

Password

into:

P@ssw0rd

It looks complicated to us, but attackers know these common substitutions well.

Swapping a few characters isn't the trick it used to be.

Think length plus uniqueness instead.

Rather than trying to remember complicated strings for every website, you can use a memorable passphrase, something like:

• I-Love-Muffins-And-Chocolate!

• Muffin-River-Cloud-Window-27!

These are examples of the structure, not passwords you should actually use.

The important idea is simple:

Make it long, make it unique, and don't reuse it.

NIST emphasizes password length and recommends passphrases when users need to create passwords themselves. It also recommends password managers and MFA or passkeys as important protections.

Step 3: Use a Password Manager

At this point you might be thinking:

"I'm supposed to remember a different long password for every account?"

No, that's exactly where a password manager helps.

A password manager can generate and store unique passwords for your accounts, so you don't have to memorize all of them.

Instead of remembering your:

• Email password

• Shopping password

• College account password

• Social media password

• Cloud account password

separately, you mainly need to protect the password manager itself.

NIST recommends using password managers because they can generate and securely store long, unique passwords for you.

Step 4: Use MFA and Passkeys

MFA stands for Multi-Factor Authentication, and the basic idea is simple:

A password shouldn't be the only thing protecting your account.

It typically combines:

• Something you know, like your password

• Something you have, like your phone or a security key

• Something you are, like your fingerprint or face

So even if someone gets your password, they may still be stopped by that second factor.

Turn MFA on for the accounts that matter most:

• Email

• Banking

• Cloud storage

• Social media

• Work accounts

• Developer accounts

Passkeys take this a step further.

You may have started seeing the word more often lately.

A passkey is an alternative to a traditional password altogether. Instead of typing one in, you authenticate using something like your device's PIN, fingerprint, or face recognition.

Passkeys are designed to resist common phishing attacks, and they're different for each service you use, so when a service gives you the option to set one up, it's worth taking.

Step 5: Learn to Recognize Phishing

You don't need to become a cybersecurity expert to protect yourself here.

A simple three-step method works well:

STOP → CHECK → ACT

STOP

Don't immediately:

• Click the link

• Reply

• Download the attachment

CHECK

Ask yourself:

• Do I actually expect this message?

• Is the sender really who they claim to be?

• Does the link lead where I'd expect?

• Is the message creating unnecessary panic?

• Is it asking for sensitive information?

• Can I verify the request independently?

ACT

Instead of clicking the link in the message, open the official application or type the website address yourself.

If your bank sends a message saying your account has been suspended and to click a link, don't click it.

Open your banking app directly and check there instead.

This one small habit prevents a surprising number of problems.

Step 6: Keep Your Devices Updated

Your phone and laptop aren't just devices.

They're containers for your digital life, holding your:

• Photos

• Messages

• Documents

• Accounts

• Authentication apps

• Saved sessions

• Personal information

Don't keep postponing updates forever.

Enable automatic updates where you can, and keep your:

• Operating system

• Browser

• Applications

• Security software

current.

CISA specifically lists software updates as one of its core recommendations for reducing online risk.

Step 7: Be Careful About What You Share

Here's a question worth asking yourself more often:

Does this website really need this information?

If an application asks for your:

• Phone number

• Exact date of birth

• Location

• Identity document

• Contacts

• Photos

pause for a moment.

Maybe it genuinely needs it. Maybe it doesn't.

You don't have to provide every piece of information simply because a form asks for it.

The less unnecessary information you share, the less unnecessary information exists to be exposed later.

But How Do I Know If My Information Has Already Been Exposed?

This is where things become practical.

You don't need to:

• Visit criminal marketplaces

• Download leaked databases

• Go looking for stolen information yourself

There are legitimate ways to check.

Check 1: See Whether Your Email Appears in Known Breaches

One useful starting point is a reputable breach-notification service such as Have I Been Pwned (haveibeenpwned.com).

You enter your email address and check whether it appears in known data breaches.

A clean result doesn't mean you're completely safe.

It only means no matching record was found in the breaches currently known to the service.

It's a starting point, not a guarantee.

If something is found, don't panic.

A breach result doesn't automatically mean someone is currently inside your account.

Instead, look at what information was actually exposed:

• An email address

• A password

• A phone number

• Something else

Your response depends on what was actually taken.

Check 2: Review Your Account Activity

Go into the security settings of your important accounts and look for:

• Recent login activity

• Devices

• Active sessions

• Connected applications

• Recovery email

• Recovery phone number

If you see a device or login you don't recognize, don't ignore it.

Investigate it.

If necessary:

• Sign out of unknown sessions

• Change the password

• Enable MFA

• Check your recovery settings

• Remove any unknown connected applications

Check 3: Look for Password Reuse

Ask yourself honestly:

Did I use this password anywhere else?

If the answer is yes, change those accounts too.

This matters especially when an exposed password was reused across multiple services.

One compromised password shouldn't be allowed to become a chain reaction across your whole digital life.

Check 4: Monitor Your Financial Accounts

Keep an eye on:

• Bank transactions

• Card transactions

• Payment applications

• Unusual purchases

• Unexpected account activity

If you see something you don't recognize, contact your bank or payment provider through an official channel, never through a phone number or link provided by a suspicious message.

Check 5: Be Extra Careful With New Messages

Suppose your email and phone number were exposed in a breach.

An attacker may now know:

• Your name

• Your email

• Your phone number

• Where you use a particular service

That knowledge can make future phishing messages far more convincing.

You might receive something like:

"Hi Anu, we noticed unusual activity on your account."

The fact that the message knows your name doesn't prove it's legitimate.

Personal information can be used to make scams look believable, so always verify independently, through channels you chose yourself.

What If I Actually Discover a Problem?

Don't panic.

A simple four-step process helps here:

CHECK → CHANGE → PROTECT → WATCH

CHECK

What information was actually exposed?

CHANGE

Change the affected password, and if you reused it elsewhere, change it there too.

PROTECT

Protect the account by:

• Enabling MFA or a passkey

• Reviewing recovery options

• Removing unknown sessions

• Removing connected applications

WATCH

Watch for:

• Unexpected login attempts

• Password-reset emails you didn't request

• Suspicious messages

• Strange account activity

• Unusual financial transactions

The goal isn't to panic.

The goal is to respond quickly and methodically.

A Beginner's Digital Security Checklist

If all of this feels like a lot, start here.

Accounts

• Use unique passwords

• Use a password manager

• Enable MFA

• Use passkeys where available

• Protect your primary email

• Review logged-in devices

Devices

• Keep your operating system updated

• Update browsers and applications

• Use a screen lock

• Avoid unknown apps and files

• Be careful with browser extensions

Messages

• Don't click suspicious links

• Don't open unexpected attachments

• Don't share passwords or OTPs

• Be suspicious of extreme urgency

• Verify requests independently

Privacy

• Share only necessary information

• Review social media privacy settings

• Remove accounts you no longer use

• Review connected applications

• Think before uploading identity documents

Monitoring

• Check for known breach exposure

• Review account login activity

• Look for unknown devices

• Monitor financial transactions

• Pay attention to suspicious messages

The Most Important Lesson

When I started thinking about this topic, I assumed cybersecurity was mostly about preventing hackers from getting into systems.

The more I looked into it, the more I realized it's also about something much simpler:

Reducing risk.

We can't control every company that stores our information.

We can't prevent every data breach.

We can't guarantee that our information will never be exposed.

But we can:

• Make our accounts harder to compromise.

• Make phishing harder to fall for.

• Use unique passwords.

• Enable MFA.

• Keep our devices updated.

• Share less unnecessary information.

• Learn how to recognize when something is wrong.

• Respond quickly when it happens.

One Final Thought

I started with a news story, because I was curious.

I ended up checking how I protect my own accounts.

And somewhere between those two things, cybersecurity stopped feeling like something only security professionals need to understand.

Every account we create leaves another small piece of information somewhere:

• Our email addresses

• Our phone numbers

• Our usernames

• Our photos

• Our documents

• Our passwords

• Our digital habits

We may not be able to make ourselves completely invisible online.

But perhaps that's not the goal.

Maybe cybersecurity is really about becoming harder to trick, harder to compromise, and quicker to respond when something goes wrong.

That feels much more achievable.

And it doesn't have to start with becoming an expert.

It can start with something as simple as deciding, today, to check your own security settings.

Being human is the default. Being curious is the choice.

The Curious Being

A Note on Sources

This piece draws on publicly available guidance from CISA (Cybersecurity and Infrastructure Security Agency) and NIST (National Institute of Standards and Technology) on password practices, MFA, and phishing prevention, along with reporting on recent breach incidents.

For your own check, Have I Been Pwned (haveibeenpwned.com) is the tool referenced throughout this piece.