You visited a website and your data leaked: how it happens and what to do

What a data leak is and what exactly leaks

A data leak is a situation where information that should stay private becomes available to people who should not see it. It can be the result of a hack, but more often the cause is simpler: a configuration error, a forgotten open server, an employee’s oversight. For the user there is no difference: the data is in the wrong hands either way.

All kinds of information can leak. It can be the name, phone number, email and address you left in order and registration forms. It can be account logins and passwords, sometimes in plain text if the site stored them insecurely. It can be purchase history and correspondence with support, account details and, in the worst cases, bank card or document data. Even the combination of “name plus phone plus what you bought” is enough for convincing fraud: the attacker calls a person, names real details and sounds like a genuine representative of the store or bank.

How data leaks from a website: the main causes

The first and most common cause is vulnerabilities in the website’s software. A site runs on a programming language, an engine, plugins and libraries, and security flaws can be found in any of these layers. A recent example is the critical PHP vulnerabilities that allowed remote code execution on a server without logging in, which we covered separately: if a server is not updated in time, the attacker gets access to everything stored on it, including customer databases. Sites that were “built once and forgotten” are especially vulnerable, because nobody installs updates on them.

The second cause is forgotten and exposed services. This is a test server left over from an old project, a database without a password reachable from the internet, an admin panel with a factory password. Automated scanners find such points within seconds and without any hacking, as we described in detail in our article on open ports. The third is weak and reused passwords. If a person uses the same password on several sites, a leak from one of them lets attackers try that password on others: this technique is called credential stuffing, and it works precisely because people reuse passwords.

The fourth cause is foreign code on the page. Modern sites load many external scripts: analytics, chat widgets, advertising pixels, payment forms. If one of these external sources is hacked or replaced, malicious code ends up inside your site and can quietly copy the data people enter into forms, including payment data. The fifth cause is phishing and fake sites: the user lands on a copy of the real site and enters the data to the attacker themselves. Finally, the sixth is the human factor and automation errors: an employee puts a file with the customer database in public access, sends it to the wrong recipient or, as in the PixelLeak case, an AI agent independently publishes internal screenshots in a public repository. None of this requires a “hacker attack”; a single slip is enough.

Why a leak goes unnoticed for so long

Unlike a site breakdown, a leak gives no sign of itself. The site keeps working as usual, orders go through, pages open, while data is quietly copied to someone else’s storage. Neither the user nor the site owner sees any signal until something noticeable happens: a stream of scam calls, mass customer complaints, the database appearing on a closed forum or a message from an outside researcher.

That is why weeks and months often pass between the moment the data left and the moment anyone found out. During that time the stolen information gets used and resold. This is exactly why security starts from the assumption that a leak is possible and provides protection and monitoring in advance, instead of waiting for the problem to reveal itself.

What a user should do: a step-by-step plan

If you suspect your data has leaked from a website, act in order and do not delay. First find out what exactly could have leaked: only contact details, a password, or payment information as well. The urgency and the set of steps depend on this.

• Change your password on that site and everywhere you used the same one. Every service needs its own unique password, and a password manager is a convenient way to store them. Start with email, banking services and social networks, since through email an attacker can reset access to everything else.
• Turn on two-factor authentication wherever it is available, especially for email and financial services. Even if the password is stolen, logging in without the second factor is much harder.
• Check whether your data appears in known leaks. There are checking services for this, for example Have I Been Pwned: you enter your email address and see which known leaks it appeared in. This does not guarantee completeness, but it helps you understand the scale.
• If card data may have leaked, contact your bank. The bank can block or reissue the card and will help dispute suspicious transactions. Do not wait for charges to appear.
• Be on guard with calls, SMS and emails. Scammers use real details from the leaked database to look convincing. Do not read out SMS codes, do not follow links in messages and call the organization back yourself using its official number.
• Monitor your accounts and statements for several months. Leaked data may not be used right away, so vigilance is needed long afterwards too.
• Tell the website what happened. If you are sure the leak came from a specific site, write to its support: the company may not know about the problem yet, and your message can help it react.

What not to do: panic and install “antiviruses” and “cleaners” from ads, pay anyone who offers to “remove your data from the internet”, or follow links in a leak notification email without making sure it is genuine. Scammers often send fake breach notifications to get even more data.

How to check a website before leaving your data on it

You cannot fully protect yourself from leaks on someone else’s website, but you can reduce the risks. First make sure the address is spelled correctly and the site opens over a secure connection: the browser bar should show a padlock and the HTTPS protocol. This does not mean the site is honest, but you definitely should not submit data without HTTPS. Look at the site itself: clear contacts and company details, a privacy policy, return terms, real reviews rather than only enthusiastic texts. Fresh, real information and a tidy site suggest that someone is looking after it.

Pay for online purchases in ways that do not require entering card data directly on a little-known site: through well-known payment systems and wallets, or a virtual card with a limited balance. Do not leave unnecessary data: if a form asks for something not needed for the order, that is a reason to be wary. And remember the main rule: the fewer people and sites have your data, the fewer places it can leak from.

What a business must do to prevent a leak

While a user can only reduce the consequences, only the site owner can prevent the leak itself. The foundation of protection is boring but effective: regularly update software, including the programming language, the site engine, plugins and server components. When critical fixes are released, they must be installed within days, not months, because once a vulnerability is publicly disclosed, attempts to exploit it begin very quickly.

You need to know your own infrastructure: which servers, subdomains and services belong to the company and are reachable from the internet, and close or disable the unnecessary ones. Remote access should be restricted through a VPN, factory passwords changed, and employee access granted at the minimum necessary level and revoked on departure. Customer data must be stored securely: passwords only in hashed form, payment data with a certified provider rather than on your server, HTTPS everywhere, and backups protected as carefully as the main database.

Do not forget external code: every connected third-party script is a potential risk point, so keep only the ones that are truly needed and watch their sources. If you use AI tools and automation, limit their permissions and control where they can send information. From the legal side, a site that collects data must have a privacy policy and obtain consent to processing, which we covered in our article on the personal data law. And finally, regular checks are needed: an audit of the external attack surface, monitoring of unusual activity and a clear person responsible for security.

What a business should do if a leak has already happened

If you suspect or discover a leak, the main thing is to act quickly and methodically rather than hide the problem. It helps to have an action plan prepared in advance, but even without one you can proceed step by step.

• Stop the source of the leak. Close the vulnerability or open access, revoke compromised keys and passwords and, if necessary, temporarily disable the affected part of the site.
• Record what happened. Save logs and information about which data was affected, for how many people and over what period. This information is needed both for the investigation and for the next steps.
• Bring in specialists. In a serious leak it is worth involving an information security specialist, who will help find the cause and make sure the attacker’s access is fully closed.
• Consult a lawyer about your obligations. Depending on the nature of the data and the legislation, there may be requirements to notify authorities and affected people, as well as deadlines for such notification. Specific obligations should be confirmed with a lawyer rather than relying on general advice.
• Honestly inform those affected. Tell them what happened, which data was affected and what people should do to protect themselves: change passwords, monitor transactions, be careful with calls. Openness builds more trust than silence, which usually comes out anyway.
• Fix the cause and conduct a review. Close the root problem, update processes and work out how to prevent a repeat. A leak is a reason to rethink the whole defence, not just patch one hole.

Common mistakes

The main mistake of site owners is to think “it won’t affect us, we’re small”. Most attacks are automated: they go through all the vulnerable sites they find and do not care about the size of the business. The second is postponing updates because “everything works anyway”, even though outdated software versions are the most common cause of hacks.

Among user mistakes the most common is one password for all services. Next come ignoring two-factor authentication and a readiness to enter card data on any site with an attractive price. A common mistake after a leak is staying silent: both companies that hide an incident and people who do not change passwords because “nothing happened” usually pay for it later and at a higher price.

Checklists