Quick answer
A data breach is data taken from an organisation without authorisation. A data leak is data exposed by the organisation's own mistake, with no attacker required. Credential exposure means a username and password specifically became public, which is the case that spreads to your other accounts. Account compromise means someone actually signed in. For you as an affected person, breach and leak call for the same response; credential exposure raises the urgency; account compromise is a different problem entirely.
Why the distinction is worth ten minutes
These four terms get used interchangeably in headlines, and mostly that is harmless. It stops being harmless in three situations: when you are deciding how worried to be, when you are writing an incident ticket that someone else will act on, and when a vendor's marketing implies that its product covers all four.
The definitions below are organised so that each one answers the same four questions — what happened, who caused it, what it means for you, and what to do — which is the comparison that actually helps.
Data breach
What happened: Data was taken from an organisation by someone not authorised to have it. There was an adversary, and they got in — through a stolen employee credential, an unpatched system, a compromised supplier, or occasionally an insider.
Who caused it: An attacker, acting deliberately.
What it means for you: Records about you that the organisation held are now in someone else's hands, and will likely circulate. Which records depends entirely on what that organisation stored.
What to do: Establish which fields were involved, change anything changeable — passwords above all — and expect better-targeted phishing. The organisation has notification and regulatory obligations; you do not.
For the fuller treatment of causes and types, see what a data breach is.
Data leak
What happened: Data became accessible to people who should not have had it, without anyone breaking in. A storage bucket left public, a database with no password, a misconfigured share, an export attached to the wrong email, a debug endpoint returning more than intended.
Who caused it: The organisation itself, by mistake.
What it means for you: Functionally the same as a breach. The distinction is about culpability and disclosure, not about your risk — data that was publicly reachable for a month should be assumed taken.
What to do: Exactly what you would do for a breach. Do not let "it was only a leak, nobody attacked us" in a company's statement lower your response; from your side the data is equally out.
A note on why organisations care about the difference even though you should not: it changes the legal analysis, the insurance position and the internal remediation. Those are their problems, not yours.
Credential exposure
What happened: A username or email address appeared together with a password — in plain text, or as a hash that can be cracked, or already cracked by someone else.
Who caused it: Usually a breach or leak at a service where you had an account. Sometimes phishing, where you handed the credential over directly.
What it means for you: This is the case that does not stay contained. Every other account where that password was reused is now reachable, because attackers automate exactly that: taking known pairs and trying them elsewhere. See credential stuffing for how that works.
What to do: Change that password everywhere it was used, starting with your email account, and turn on multi-factor authentication. This is the highest-urgency case on this page. The response checklist has the order.
A distinction inside the distinction: a hashed password is not immediately usable, but "hashed" covers a wide range. A modern, slow, salted hash is a real obstacle; an unsalted fast hash of a common password is effectively plain text. Treat any exposed password as exposed unless you know the specific algorithm and you know your password was long and unique.
Account compromise
What happened: Someone signed in to your account and used it.
Who caused it: Whoever had a working credential — often obtained through one of the routes above, sometimes through malware on a device, sometimes through a session token stolen after you authenticated.
What it means for you: This is active, not latent. The account may be sending messages, may have altered settings, and may have been used to reach your other accounts through password resets.
What to do: Different priority order from the others. Recovery-channel cleanup comes first — recovery addresses and phone numbers, forwarding rules, app passwords, active sessions — because those survive a password change and an attacker who keeps one keeps access. Then the password, then the accounts that use this one for resets.
How you find out: Not from breach data. Breach datasets are a record of what left an organisation, not a log of who signed in to your account. The evidence lives in the account: unfamiliar sessions, security notifications you did not trigger, sent mail you did not send.
The two most common misreadings
"My email was in a breach, so my email account was hacked." Almost always false. It usually means some company's user list included your address. That is identifier exposure, the mildest case, and it does not imply anyone has a password or has signed in anywhere.
"It was only a leak, so nothing was stolen." Not a safe assumption. Publicly reachable data is routinely found and copied by automated scanners long before anyone reports it. A leak with no evidence of access is not the same as a leak with evidence of no access, and organisations rarely have the second.
Which fields were involved matters more than which word applies
Once you have established that data about you is out, the word used to describe the event stops being the useful variable. The useful variable is what was in it: an email address alone, versus an email address with a password, versus either of those with a date of birth and a government identifier, are three different situations with three different consequences.
What information actually gets exposed in a data breach goes through the categories and why severity varies so widely.
If you want to know whether a specific address appears in known breach data, you can check an identifier — bearing in mind that a nil result means nothing was found in the data checked, not that nothing exists.
Related terms you will meet
Exfiltration — the act of moving data out of a network. A technical term for the mechanics of a breach.
Dump — an informal word for a released dataset. "The dump contained 40 million records."
Combolist — an aggregated file of address-and-password pairs assembled from many sources, built specifically to be used for credential stuffing. Combolists are why a single old breach keeps producing consequences years later.
Dark web exposure — a marketing term more than a technical one. It usually means the same breach datasets, sometimes with material from closed forums. Its limits are covered in what dark web monitoring can and cannot tell you.
Identity theft — someone using your personal data to impersonate you financially or legally. A possible downstream consequence of the events above, not a synonym for any of them.
For the whole subject end to end, see the breach exposure guide.