1.2: What "Leaked in a Breach" Actually Means
What “Leaked in a Breach” Actually Means
“Company X suffered a data breach affecting 40 million users.” You’ve read that headline a dozen times, winced, and moved on. This lesson looks at what’s inside one of those stolen databases, and why a leak from years ago is still dangerous today.
What’s in the dump
When attackers break into a company’s systems, one of the first things they take is the user database: email addresses, usernames, and passwords. Usually the passwords aren’t sitting there in readable form. They’re hashed. A hash is a one-way scrambling: the site runs your password through a mathematical function and stores only the scrambled result. The same input always produces the same output, but there is no way to run it backwards.
When you log in, the site hashes what you typed and checks whether it matches the stored scramble. The site never needs to keep your real password at all, which sounds like the problem is solved.
Why hashing doesn’t save weak passwords
You can’t run a hash backwards, but you can guess forwards. A cracking rig built from ordinary gaming graphics cards, running freely available software, can compute billions of hash guesses per second. It takes a list of likely passwords, hashes each one, and compares the results against the stolen database. Every match is a cracked account.
And the guessing list isn’t random. In 2009, a company called RockYou was breached and lost 32 million passwords stored in plain text, with no hashing at all. That list of real passwords, chosen by real people, became the standard guessing dictionary, and cracking tools have started with it ever since, because what people chose in 2009 is what people still choose now. If your password resembles anything a human commonly types — a word, a name, a date, a keyboard pattern, or any of those with a 1! on the end — it falls in seconds.
Leaks are forever, and they get merged
A breach isn’t an event that ends. The dump gets sold, then resold, and eventually stitched together with every other dump in circulation. In 2019, a file called Collection #1 appeared on a hacking forum: 773 million email addresses and 21 million unique passwords, assembled from thousands of older breaches, some nearly a decade old at the time. Files like that are what credential-stuffing software (Lesson 1.1) loads and replays.
So “that leak was ages ago” offers less comfort than it should. Old leaks don’t expire. They pile up.
There’s a public record
A security researcher named Troy Hunt has spent years collecting breach dumps into a free public service called Have I Been Pwned: a searchable record of which breaches contain your email address, plus a separate database of hundreds of millions of leaked passwords. It’s the closest thing the internet has to a public health registry for stolen credentials. In Module 5 you’ll set up its alerts so it watches your addresses permanently. In Module 2 you’ll use its password database right here on this site, without your password ever leaving your browser.
The takeaway
A password that has ever leaked, anywhere, stays burned forever. Machines will keep trying it against every site that matters to you for as long as you live. In Module 2 you’ll check your old standbys against the record, safely, and you may discover that one of them has been on the lists for years.