Breach research

5 Things in a Data Breach Worse Than a Leaked Password

September 21, 2026

You can change a leaked password in about a minute. Try changing your date of birth.

That’s the whole argument, really. Breach advice has been stuck on “change your password” for fifteen years, and for most of those years it was the right call, because passwords were the thing that leaked.

In our catalog they aren’t anymore. Not mostly.

Quick context if you’re new here. I run XposedOrNot. It’s free, it’s open source, and it does one job: you type in an email address and it tells you which public breaches that address appears in, and what each one exposed.

The engine under it is a catalog of 783 public breaches. For every one of them we record which kinds of data got out (the categories only, never the data: “passwords”, “phone numbers”, “dates of birth”).

It’s all queryable through an open API with no key, and every number below came out of it on 21 September 2026, so you can pull the same data and check me.

The numbers first. Of the 398 breaches dated 2019 or earlier, 341 exposed passwords. That’s 85%.

Of the 76 dated 2026, it’s 8. Ten percent. And it didn’t happen overnight:

Breach dated	Breaches	Exposed passwords	Exposed phone numbers	Exposed home addresses
2019 and earlier	398	85%	15%	13%
2020 to 2022	188	69%	43%	29%
2023 to 2025	121	30%	61%	48%
2026	76	10%	76%	69%

Grouped bar chart of the XposedOrNot catalog by breach year: the share of breaches exposing passwords falls from 85% to 10% across four periods while phone numbers rise from 15% to 76% and home addresses from 13% to 69% — Figure 1: Same catalog, grouped by when the breach happened. Passwords slide the whole way down; phone numbers and addresses climb the whole way up.

So the five things below aren’t a thought experiment. They’re what is actually in the files now.

The short version

“Worse than a password” means two things at once: you can’t reset it, and it helps a stranger pass as you somewhere else.
The five: your date of birth, government ID numbers, security answers, your home address, your phone number.
402 of the 783 breaches in our catalog (51%) carry at least one of them. 66 carry a name, a date of birth and a home address together.

A word on units, since I’m about to throw billions around. A record is one exposed entry in one breach, and the same person turns up in lots of breaches, so none of these totals is a headcount. Records, not people.

What makes a leak “worse”?

Two questions. Can you rotate it? And does it prove who you are somewhere else?

A password fails the second test only if you’ve reused it, and it passes the first one easily. New password, done, and if a manager is generating them the damage stops at that one site. Annoying, but you’ll live.

Now run the same two questions over everything else a breach can carry:

What leaked	Breaches (of 783)	Records	Can you change it?
Date of birth	197	2,746,576,287	Never
Government ID numbers (SSN, passport, national ID)	24	166,853,223	Almost never
Security questions and answers	7	13,483,808	The facts, no. What you tell the site, yes
Home address	220	2,089,990,108	Only by moving
Phone number	277	2,893,578,141	Yes, and you’ll hate it
For scale: passwords	516	6,750,022,029	In a minute

I’ve ordered them by how stuck you are, not by how often they leak. If it were by frequency, phone numbers would lead. (If you only want to check what leaked about you, that takes ten seconds and you can come back.)

Six things a breach can expose placed on a rail from easy to reset to stuck for life: password, phone number, home address, security answers, ID number, date of birth, with the number of catalog breaches exposing each — Figure 2: The reset test. The further right, the longer you live with it.

1. Your date of birth

It never expires and you can’t get a new one. And for some reason half the planet still uses it as a secret.

Think about the last time you phoned your bank, your insurer, your mobile carrier. “Can you confirm your date of birth?”

It’s a verification question almost everywhere, which would be fine if it weren’t sitting in 197 of the breaches we index. One in four.

There’s no fix for the leak itself, so the fix is attitude. Treat your date of birth as public, because it probably is.

And where nothing legal or financial hangs on it (a forum, a game, a newsletter that wants to send you a birthday coupon), give a different one and let your password manager remember which (account recovery may ask for it one day). The less often the real date is on file, the fewer files it can leak from.

2. Government ID numbers

This one’s rarer, and a lot heavier.

I merged every label in the catalog that means “a number a government gave you”: social security numbers, passport numbers, national IDs, the partial ones too. That’s 24 breaches and 166 million records. Small next to the phone-number pile, and five of those 24 are dated this year.

Why is it the heavy one? Because this is the number that opens credit, files tax returns and passes a formal identity check. You can’t casually rotate it either.

A replacement passport usually comes with a new number, but the old one was already copied into whatever file it leaked from, and national ID and social security numbers are close to permanent.

If you’re in the US and one of these is out, two moves matter more than the rest. Freeze your credit with all three bureaus (the FTC’s guide to freezes and fraud alerts walks through it).

Then get an Identity Protection PIN from the IRS, a six-digit number that stops anyone else filing a return under your SSN.

Outside the US the shape is the same even if the agencies aren’t: tell the issuer, and lock whatever that number can open.

3. Security questions and answers

Seven breaches in the catalog. The smallest number on this page, and the one that annoys me most.

A security answer is a password you were told to build out of facts.

Your mother’s maiden name. Your first pet. The street you grew up on.

Facts don’t change, other people know them, and once one leaks it’s leaked for every site that ever asked you the same question. (And they all ask the same six questions.)

NIST gave up on the idea years ago. Its 2017 digital identity guidelines say verifiers “SHALL NOT prompt subscribers to use specific types of information (e.g., ‘What was the name of your first pet?’)”. Plenty of sites still do.

So lie. Properly.

Treat each answer as a second password: a few random words, stored in your manager, different on every site. (Words, not gibberish. A support agent on the phone will wave through “it’s just a bunch of letters”, and that’s no use to you.)

Your first pet was called blue-harbor-violin-tuesday, and nobody’s going to find that on your Facebook.

4. Your home address

More than two billion address records sit in our catalog, spread over 220 breaches. Of this year’s 76 breaches, 53 carry one.

An address on its own isn’t a catastrophe; it’s on every parcel you’ve ever received. The trouble is what it’s bundled with.

Sixty-six breaches in our catalog carry a name, a date of birth and a home address in the same file. That’s 1.24 billion records’ worth of the three things that, in our experience, most call-centre scripts ask for. Fifty-nine of those add a phone number on top.

It’s also the one leak on this list that leaves the internet. A message that quotes your real street address feels legitimate in a way no “Dear Customer” email ever will.

Parcel-fee texts, fake fines, the “we’ve got video of you” extortion letters that paste in a photo of your house. The ones that land hardest quote a real address.

You can’t un-leak where you live (short of moving, and please don’t move because of a blog post).

What you can do is reset one reflex: accurate personal details in a message prove nothing. They’re in the files. Anyone can have them.

5. Your phone number

The most common of the five. 277 breaches, 35% of the catalog, and 58 of the 76 dated this year.

Technically you can change it, which is why it sits last. Practically?

It’s tied to your bank, your messaging apps, your two-factor codes and every relative who only ever calls. Most people would sooner change their name.

And that’s exactly why attackers want it. A phone number is a login for a surprising number of services, and it’s the delivery address for SMS codes.

The attack is called SIM swapping: someone talks your carrier into moving your number onto their SIM, and your codes start arriving on their phone.

The FBI’s Internet Crime Complaint Center counted 320 SIM-swap complaints across 2018 to 2020, about $12 million in losses, and then 1,611 complaints and more than $68 million in 2021 alone.

Two fixes, both free. Ring your carrier (or open their app) and ask what stops a SIM swap on your account. Most big carriers have something: in the US it’s usually called a port-out PIN or Number Lock, and almost nobody turns it on.

Then move your important accounts off SMS codes and onto an authenticator app or a passkey, and check the number isn’t still sitting there as a recovery option. After that a leaked number is mostly a spam problem. I went deeper on this one in why a leaked phone number is worse than a leaked email.

“But my password leaked too”

Then change it. I’m not arguing passwords stopped mattering. They’re still in 516 of our 783 breaches, most of them stored badly, and a reused one is still the fastest way to lose an account.

The argument is about where your attention goes after the reset. Change the password and that problem’s over. The other five just sit there, in a file that gets traded and resold for years.

So after a breach notice I’d skip “was my password in it?” and ask what else was.

Which is a question we can actually answer. Check your email on XposedOrNot and each breach in the result lists the data classes it exposed, so you can see in ten seconds whether you’re dealing with a password reset or a date-of-birth-and-address problem.

No signup. If you’ve never done it, this walkthrough shows what the results mean.

What to do this week, in order

Run the check and read the data classes, not just the breach names.
Government ID in the list? That one goes first. In the US, freeze your credit; anywhere else, ring whoever issued the ID and ask what they can lock.
Then your mobile carrier. Ask them to switch on whatever they’ve got against SIM swaps (US carriers call it a port-out PIN). Ten minutes on hold, once.
Move your main email and your bank off SMS codes.
Replace your security answers with random ones, starting with your email account, since that’s the one that resets all the others.
From now on, a message that knows your address and your birthday has proven nothing at all.

And if you’d rather your email address stopped turning up in other people’s searches, Privacy Shield takes your email out of public lookups on our side. It doesn’t pull anything back from the breach files (nothing can), but it’s one less place to be found.

The caveats

Our catalog is public breaches that we’ve indexed, not every breach that happened. Quiet ones, and ones nobody dumped, aren’t here.
Data classes are our labels, assigned per breach from what the leaked files and the reporting show. Government IDs appear under six different labels in the catalog (“Government IDs”, “Government issued IDs”, “National IDs”, “Partial government issued IDs”, “Passport numbers”, “Social security numbers”); I merged them. Security answers merge two labels.
The shift away from passwords is real in our data (a steady slide since 2020, and it holds year by year, not only in the four buckets above), and I’d be careful about the why. A lot of this year’s entries are customer-record files (the kind pulled from CRM and support systems), which hold contact details and no passwords at all. Older entries lean towards forum and game databases, which were mostly usernames and password hashes.
Different targets, different files. And this is our catalog sorted by breach date, not every breach on earth, so read the percentages as a direction.
Breach dates are recorded to the month.
Records, not people. Two billion address records is not two billion households.

FAQ

What is the most dangerous information to lose in a data breach?

Anything you can’t change that also proves your identity: your date of birth, government ID numbers, security answers, home address and phone number, in that order of how stuck you are, and ID numbers do the most damage per leak. A password is the least dangerous item on the list, because it can be replaced in a minute. Going by the breaches we’ve indexed at XposedOrNot, 402 out of 783 exposed at least one of those five, so a bit over half (September 2026).

Is a leaked phone number worse than a leaked password?

For most people it is, because a password resets in a minute and a phone number really doesn’t. Yours is wired into your bank, your messaging apps and your SMS login codes, and it’s what a SIM-swap attack goes after. We see phone numbers in 277 of the 783 breaches we index (35%), and in 58 of the 76 dated 2026.

What should I do if my date of birth was in a data breach?

You can’t change it, so reduce what it unlocks. Freeze your credit (in the US) if an address or ID number leaked alongside it, stop treating your birthday as a secret when someone uses it to “verify” you, and give a different date to sites that have no legal need for the real one.

Every figure in this post can be reproduced from the public endpoint at api.xposedornot.com/v1/breaches, using the breachedDate and exposedData fields as they stood on 21 September 2026. The catalog grows most weeks, so your numbers will drift up from mine.

Want to know which of the five you’re actually dealing with? Ten seconds at xposedornot.com, free, no signup.

And if this was useful, a star on GitHub helps other people find the project. Honestly, it makes our day.