Most people think a data breach is the worst that can happen. In reality, the breach is just the beginning. What follows is a chain of exploitation that can last years.
Stage 1: The Breach (Day 0)
An attacker gains access to a database containing user records. This might happen through a software vulnerability, a misconfigured server, stolen employee credentials, or a supply chain attack. Most breaches go undetected for weeks or months.
Stage 2: Data Exfiltration (Days to Weeks)
The attacker copies the database. Depending on the target, this could include email addresses, passwords (hashed or plaintext), phone numbers, addresses, payment information, and identity documents.
Stage 3: Private Sale (Weeks to Months)
Fresh breach data is valuable. The attacker sells it privately to a small group of buyers on dark web marketplaces. Prices range from a few dollars for basic email/password lists to thousands for databases with financial information.
Stage 4: Credential Stuffing (Months)
Buyers use the data to attack other services. Every leaked email/password pair gets tested against banking sites, email providers, social networks, and shopping platforms. Accounts with reused credentials get compromised.
Stage 5: Public Leak (Months to Years)
Eventually the data gets shared widely. It appears on public paste sites, free download forums, and aggregated breach databases. At this point, anyone can access it. Your data is permanently public.
Stage 6: Enrichment and Resale (Ongoing)
Data brokers combine your leaked records with information from other breaches, public records, and purchased datasets. The resulting profile is far more detailed than what any single breach contained.
How Disposable Identities Break the Chain
If the breached account used a synthetic identity:
- The leaked email leads nowhere because the inbox is disposable
- Credential stuffing fails because the email is not used on any other service
- Profile enrichment produces a fictional person, not a real one
- The entire exploitation chain produces zero real-world damage