Big breaches follow a few repeating patterns: a known flaw left unpatched, a company that stayed quiet for too long, or a single vendor that held data for millions. You can’t prevent a company from being breached, but you can limit the damage: freeze your credit, use unique passwords with multi-factor authentication, and treat any message that mentions a breach as unverified until you confirm it independently.
Most people will receive a breach notification letter at some point. The three breaches below are among the largest on record, each documented by a government agency, and each teaches a different lesson about what goes wrong and what you can do afterward.
Equifax (2017)
In July 2019, the FTC announced a settlement with Equifax over its 2017 breach, which affected approximately 147 million people. According to the FTC, the exposed data included at least 147 million names and dates of birth, 145.5 million Social Security numbers, and 209,000 payment card numbers and expiration dates, along with physical addresses.
What makes Equifax instructive is how preventable it looked. The FTC said Equifax was alerted in March 2017 to a critical vulnerability in one of its databases. Its security team ordered the affected systems patched within 48 hours, but no one followed up to confirm the work was done, and the unpatched database wasn’t discovered until July 2017. Hackers who exploited the flaw reached an unsecured file with administrative credentials stored in plain text, and operated undetected for months. The FTC also said Equifax didn’t segment its database servers and stored sensitive data, including Social Security numbers, in plain text.
Equifax agreed to pay at least $575 million, and potentially up to $700 million, in a global settlement with the FTC, the Consumer Financial Protection Bureau, and 50 U.S. states and territories. That included $300 million for a consumer fund, $175 million for the states, and $100 million in CFPB civil penalties. FTC Chairman Joe Simons said “Equifax failed to take basic steps that may have prevented the breach.” Read the FTC announcement.
The lesson: A Social Security number can’t be changed like a password. Once it’s exposed, the protection has to come from you, through a credit freeze and ongoing monitoring.
Yahoo (2014): The Cost of Staying Quiet
In April 2018, the SEC announced that the entity formerly known as Yahoo would pay $35 million to settle charges related to a December 2014 intrusion. Hackers stole data from “hundreds of millions of user accounts,” including usernames, email addresses, phone numbers, birthdates, encrypted passwords, and security questions. According to the SEC, Yahoo’s security team learned of the breach within days, but it wasn’t disclosed to the public until 2016, more than two years later, while Yahoo was closing its acquisition by Verizon. Yahoo neither admitted nor denied the findings. SEC press release.
The lesson: If a company sat on a breach for two years, you may have been exposed long before you were told. Passwords and security answers from that era may still be in use on other accounts, which is why unique passwords matter.
Change Healthcare (2024): When One Vendor Holds Everyone’s Data
In 2024, a ransomware attack on Change Healthcare, a company that processes health care payments and claims, became what the HHS Office for Civil Rights calls an attack of “unprecedented magnitude,” with “widespread impact on patients and health care providers nationwide.” Change Healthcare’s first report to OCR, filed July 19, 2024, listed 500 individuals, the minimum for posting on the HHS Breach Portal, while the total was still being determined. OCR’s page records later updates: about 190 million individuals by January 2025, and about 192.7 million by July 2025. OCR opened investigations into Change Healthcare and its parent, UnitedHealth Group.
Many of the people affected had never heard of Change Healthcare. It worked behind their doctors, pharmacies, and insurers. OCR notes that the covered providers and health plans are responsible for making sure individuals are notified. HHS OCR, Change Healthcare FAQ.
The lesson: You can be breached through a company you didn’t choose. Watch for notices from your provider or insurer, and treat health data as permanent, since it can’t be reissued either.
Patterns Across the Three Breaches
| Pattern | Where it showed up | What you can do |
|---|---|---|
| A known flaw left unpatched | Equifax | Keep your own devices on automatic updates |
| Slow or no disclosure | Yahoo | Check your email at Have I Been Pwned instead of waiting for a letter |
| Concentrated third-party data | Change Healthcare | Read breach notices from every company that holds your data, including ones you’ve never heard of |
| Data that can’t be changed | Equifax (SSNs), Change Healthcare (health records) | Freeze your credit and watch for medical identity theft |
What to Do After a Breach
Match your response to what was exposed.
If your Social Security number or date of birth was exposed:
- Freeze your credit at each of the credit bureaus (Equifax, Experian, and TransUnion). A freeze stops new accounts from being opened in your name, and you can lift it when you need credit. Alternatively, place a fraud alert.
- Check your credit reports for accounts you don’t recognize.
- Go to IdentityTheft.gov to report identity theft and get a recovery plan if anything looks wrong.
If a password was exposed:
- Change it right away on that account and anywhere you reused it.
- Switch to unique passwords from a password manager.
- Turn on multi-factor authentication, ideally with an authenticator app or passkey.
If payment card details were exposed:
- Call the card issuer using the number on the card and ask for a replacement.
- Review recent statements for charges you don’t recognize.
If health information was exposed:
- Read your insurer’s and provider’s explanation-of-benefits statements for services you didn’t receive.
- Ask your provider or insurer what was involved if you receive a notice.
In every case:
- Expect follow-up scams. Criminals send fake “breach notification” emails and calls offering free credit monitoring or asking you to “verify” details. Don’t click. Go to the company’s real website yourself. See our guides to spotting phishing and social engineering.
- Keep the notification letter, and note the date.
- Report fraud at ReportFraud.ftc.gov or ic3.gov.
How to Lower Your Risk Before the Next One
- Use a unique password for every account, so one breach doesn’t open the rest.
- Delete accounts you no longer use, because old accounts hold data you’ve forgotten about. See digital minimalism for privacy.
- Keep backups and know the signs of ransomware.
- Learn what dark web monitoring can and can’t tell you.
People Also Ask
Search your email address at Have I Been Pwned, watch for notification letters from companies, and check whether companies you use have posted a notice on their website.
If your Social Security number or other identifying information was exposed, a credit freeze is one of the strongest steps, since it blocks new accounts from being opened in your name. You can lift it temporarily when you apply for credit.
A freeze blocks access to your credit report for new accounts. A fraud alert tells lenders to verify your identity before opening credit. Place the freeze with each bureau separately.
Sometimes they’re still investigating, and sometimes they delay for other reasons. In Yahoo’s case, the SEC found the company knew within days but disclosed publicly two years later.
Sometimes. Equifax, for example, funded a consumer fund as part of its FTC settlement. Whether you qualify depends on the case, so check the official settlement notice you receive rather than a link in an unexpected email.
It can be, because it’s permanent and can be used for medical identity theft or targeted scams. Review your insurance statements for services you didn’t receive.
Sources: Federal Trade Commission, “Equifax to Pay $575 Million as Part of Settlement with FTC, CFPB, and States Related to 2017 Data Breach” (July 2019); U.S. Securities and Exchange Commission, Yahoo settlement press release 2018-71 (April 2018); HHS Office for Civil Rights, Change Healthcare Cybersecurity Incident FAQ; IdentityTheft.gov
Leave a Reply
You must be logged in to post a comment.