The breach may be over. The exposure may not be.
Companies close incidents. Data does not close itself. A breach notice tells you what an organization discovered, not where your data is now, how easily someone can retrieve it, or what can be built by combining it with other sources.
Companies manage the incident. You live with the data.
Most breach reporting follows a familiar story. Data was exposed. The company investigated. Systems were restored. Notices were sent. The matter was closed.
That story may be accurate. It still describes the organization’s response, not the current condition of your data.
Copies can remain after a case closes. Old data can become easier to search. A password may expire while a birth date, old address, or family relationship stays useful. Separate records can also be joined into a new target list that no company ever held.
The usual breach story leaves out the parts that matter later.
Each statement below sounds reasonable. Each can also be wrong in a way that creates false reassurance.
“A notice tells me my current exposure.”
A notice records a determination, a date, and categories of information. It does not track every copy or tell you what is retrievable today.
“The incident was resolved, so the data is gone.”
Operations and legal matters can close. No available party can prove that every hostile copy was destroyed.
“If a file exists, it is equally usable.”
An unparsed archive and a cheap searchable lookup can contain the same records and create very different exposure.
“The breach is old, so the data is stale.”
Some fields expire. Others remain useful for decades. A field can also stop locating you and still help someone impersonate you.
“No company had the target list, so it could not exist.”
Two ordinary-looking sources can be joined into a new, actionable dataset that was present in neither source alone.
“A wrong match is harmless.”
A bad classification can still point to a real person or a real address. Error can move the harm rather than remove it.
We assess the data, not the paperwork around it.
The full research uses a structured model. You do not need the terminology to understand the core questions.
What information is actually in play?
A password, home address, birth date, health record, and family relationship do not behave the same way.
Start with the fields, not the breach count.How far has it been shown to move?
Possession, transfer, and wider circulation are different findings. “Not assessed” does not mean “no.”
Record what is evidenced and what remains unresolved.How easy is it to retrieve today?
Risk changes when a file becomes indexed, searchable, packaged, or cheap to obtain by a useful selector.
The interface can matter more than the file.Does the record really point to this person and place?
A population-level finding, a plausible match, and an observed record carry different confidence.
Treat resolved records as leads until verified.What can each field still help someone do?
Data can locate, authenticate, support a believable pretext, or connect records across systems. Those uses age differently.
Time changes the use, not just the value.What can be built by combining it?
An affiliation plus an email or phone number plus a commercial locator can create a target list that never appeared in a breach.
The dangerous object may be created later.The same breach can contain six different clocks.
The age of the incident is a poor shortcut. The useful life of each field depends on what someone wants to do with it.
| Field | What changes | What may remain | Best response |
|---|---|---|---|
| Password | It can become useless after replacement. | Account history and reused patterns may still matter. | Replace it. End active sessions. Remove reuse. |
| Session token | It may expire quickly or be revoked. | Device and account context may remain useful. | Revoke it. Review session controls. |
| Email or phone | Contactability can change. | It can remain a durable join key across datasets. | Compartmentalize. Avoid tying residence and affiliation to one identifier. |
| Home address | It may become stale as a current locator. | Household, property, and relationship value can persist. | Reduce public linkage. Protect current and prior occupants. |
| Old address or employer | It may stop describing your present life. | It can support pretext, verification, and record linkage. | Do not treat personal history as proof of identity. |
| Birth date or government ID | Very little. | Verification and identity-graph utility can remain for life. | Plan around persistence. Strengthen verification elsewhere. |
Act on what can change. Plan around what cannot.
Keep the notice and field list
The category list may be the only durable record of what was involved. Save it even after the public incident page disappears.
Replace revocable secrets fast
Change passwords. Revoke sessions and tokens. Review recovery methods. Close the functions that can actually be closed.
Stop using personal history as proof
Birth dates, former employers, relatives, and old addresses can be discovered. They should not authenticate a caller.
Break links to the residence
Separate public affiliations, convenience accounts, vehicles, payment identifiers, and home contact details where practical.
Monitor current accessibility
A breach count is history. Recheck whether the data has resurfaced, become searchable, or been incorporated into a new corpus.
Verify before acting on a record
Aggregated and derived data can be stale, merged, or wrong. Include household members, staff, and prior occupants in the verification step.
This is not a claim that every breach stays dangerous forever.
- Accessibility can improve. A seizure, takedown, or delisting can remove a real retrieval path.
- Not every field remains current. Old data can be wrong, stale, or mismatched.
- Not every incident creates unique exposure. Another copy of a widely circulating identifier may add little.
- Not every derived list is accurate. Accuracy and actionability are separate questions.
- This model does not predict harm. It describes exposure conditions and the evidence supporting them.
This is the research. The corpus is the evidence.
Everything on this page is drawn from a standing record of breaches whose data has been observed in circulation rather than merely disclosed: roughly 950 of them, each with its own page showing what was exposed, what the combination enables, and what to do about it.
Each record carries a Breach Risk Index score, which is what makes two breaches comparable rather than merely both alarming.
Start with the overview. Dig deeper only where it matters.
This page is the navigation layer. The Command Briefs carry the evidence, qualifications, and analytic detail. All of it is searchable in the Intelligence library ↗.
See the core mistake
Use the visual summary of the four false equivalences.
Read the synthesis
CB-234 consolidates the doctrine and controls the vocabulary.
Follow the mechanism
Read CB-230 through CB-233, then CB-235 and its join-recipe annex.
FIGUREFour false equivalences+
The fastest visual explanation: notice is not state, closure is not destruction, possession is not usability, and age is not decay.
Open visualCB-234The breach is not the exposure+
The synthesis brief. It replaces the event story with a current assessment of distribution, accessibility, match, utility, evidence, and collection state.
Read synthesisCB-230What a breach notice cannot establish+
A breach notice is a historical disclosure. It does not establish where the data went or whether it is retrievable now.
Read briefCB-231What payment cannot buy+
Operational closure and incident closure can be evidenced. The destruction of every copy cannot.
Read briefCB-232The cost of a name+
The same records create different exposure depending on the retrieval path, search interface, cost, and selector.
Read briefCB-233Age is not decay+
Data does not age as one record. Each field remains useful for different purposes and on a different clock.
Read briefCB-235The file that was never breached+
Separate sources can be joined into a new target class that no source custodian ever held and no breach notice ever described.
Read briefAX-235Join recipes+
A reference catalogue of documented composition patterns for analysts, product teams, and advanced readers.
Open annexThe breach record tells you what happened.
Exposure assessment asks what remains useful, reachable, attributable, and combinable now. If the question in front of you is your own household’s exposure, that is the audit, and it starts with a call.
We assess what the data can still do.