Data Breaches: What Happens to Your Passwords When a Service Is Hacked
Sooner or later a service you use will show up in a security headline. What that means for you depends entirely on what kind of incident it was — and on whether your password was unique.
Breach, scrape or credential stuffing?
In a breach, the service’s own systems are compromised and stored data — sometimes password hashes — is stolen. In a scrape, public or semi-public data is harvested through an exposed interface; no passwords are taken. Credential stuffing runs in the opposite direction: passwords leaked elsewhere are tried against the service. Headlines rarely distinguish the three — your response should.
What happens to a leaked password hash
Serious services store passwords hashed, not readable. But a leaked hash can be attacked offline at trillions of guesses per second, and short or predictable passwords are recovered within hours. This is why length and randomness matter even when the stolen data “was encrypted”.
What to do when a service you use is hit
Change the password on the affected service — and everywhere you had reused it, then stop reusing passwords altogether. Enable two-factor authentication. And expect targeted phishing afterwards: leaked email addresses and names are used to write convincing fake “reset your password” mails.
Documented incidents at major services
- 2026Instagram — In 2026, data from about 6.2M Instagram accounts was harvested through an exposed interface (names, email addresses, phone numbers, and profile data) — no passwords were stolen.
- 2023Discord — In 2023, an incident at a third-party vendor exposed a limited amount of Discord user data (email addresses).
- 2023Duolingo — In 2023, data from about 2.6M Duolingo accounts was harvested through an exposed interface (email addresses, names, and profile data) — no passwords were stolen.
- 2023Facebook — In 2023, an incident at a third-party vendor exposed a limited amount of Facebook user data (email addresses, names, and passwords).
- 2022PayPal — In 2022, about 35K PayPal accounts were hijacked in credential-stuffing attacks using passwords reused from other leaks.
- 2022Roblox — In 2022, an incident at a third-party vendor exposed a limited amount of Roblox user data (email addresses and names).
- 2022X (Twitter) — In 2022, data from about 5.4M X (Twitter) accounts was harvested through an exposed interface (email addresses, phone numbers, and profile data) — no passwords were stolen.
- 2021EA (Electronic Arts) — In 2021, attackers stole EA (Electronic Arts) source code — no user passwords were affected.
- 2020Spotify — In 2020, about 300K Spotify accounts were hijacked in credential-stuffing attacks using passwords reused from other leaks.
- 2019Facebook — In 2019, data from about 533M Facebook accounts was harvested through an exposed interface (phone numbers, names, and profile data) — no passwords were stolen.
- 2019Instagram — In 2019, data from about 49M Instagram accounts was harvested through an exposed interface (profile data, phone numbers, and email addresses) — no passwords were stolen.
- 2018Facebook — In 2018, Facebook suffered a data breach affecting about 50M accounts (profile data).
- 2016Epic Games — In 2016, Epic Games suffered a data breach affecting about 251.7K accounts (email addresses and hashed passwords).
- 2016Roblox — In 2016, Roblox suffered a data breach affecting about 52.5K accounts (email addresses and profile data).
- 2014iCloud Mail — In 2014, iCloud Mail accounts were hit by targeted phishing and password-guessing attacks — iCloud Mail’s own systems were not breached.
- 2014Snapchat — In 2014, data from about 4.6M Snapchat accounts was harvested through an exposed interface (usernames and phone numbers) — no passwords were stolen.
- 2013Ubisoft — In 2013, Ubisoft suffered a data breach (usernames, email addresses, and hashed passwords).
- 2011PlayStation — In 2011, PlayStation suffered a data breach affecting about 77M accounts (names, email addresses, hashed passwords, and profile data).
- 2011Steam — In 2011, Steam suffered a data breach affecting about 35M accounts (email addresses, hashed passwords, and payment details).
Curated from public reporting and vendor statements; incident types follow the definitions above. Each service links to its password guide.
Security Guides
How Long Should a Password Be?
How password length affects cracking time — real numbers per length and character set, plus recommendations for accounts, email and master passwords.
The Most Common Password Mistakes
Six password mistakes attackers exploit every day — reuse, personal details, keyboard patterns, l33t substitutions, short passwords and unsafe storage — and what to do instead.
Two-Factor Authentication (2FA): What It Is and Why It Matters
How two-factor authentication works, which method to choose — security key, authenticator app or SMS — and which major services support it.
Do You Need a Password Manager?
Why a password manager is the only realistic way to keep a unique, random password for every account — and how to protect the vault itself.
Data Breaches: What Happens to Your Passwords When a Service Is Hacked
Breach, scrape or credential stuffing? What each incident type means for your passwords, documented incidents at major services, and what to do when it happens.