Data breaches expose millions of records; change passwords if you're affected.
Breaches happen through several mechanisms: attackers exploit vulnerabilities in a company's systems, employees fall for phishing emails that hand over internal access, insiders intentionally or accidentally expose data, and misconfigured databases are left publicly accessible. In all cases, the user whose data is exposed had no control over the event.
The data typically exposed in a breach includes email addresses and hashed passwords (which can be cracked offline), phone numbers, names and addresses, payment card details (if stored), and in more serious breaches, national ID numbers, financial records, or health data.
When you receive a breach notification, act immediately: change the password on the affected site and every other site where you used the same password. Enable 2FA on the affected account. Monitor your credit report and financial statements for unusual activity if financial data was exposed.
Use HaveIBeenPwned (haveibeenpwned.com) to check whether your email addresses have appeared in known public breaches. Enable the notification service to be alerted if your address appears in future breaches. This is a free, reputable service run by security researcher Troy Hunt.