What a Breach Exposes
Ten million records. Is that bad?
The idea
The damage from a breach depends on what was stored and how, not on the number of records.
In the real world
Millions of properly hashed passwords may matter less than a few thousand plain-text ones.
Going deeper
Severity is determined by which fields were taken and how they were stored, not by the record count that leads the headline.
Ten million strongly hashed passwords are not directly usable; five thousand in plain text are immediate access. Security question answers are worse than either, because they cannot be changed and are reused across services. Reading the detail of a breach notice tells you whether to change one password or to audit everything connected to that account, and those are very different responses.
Where it stops applying
Hashing quality varies enormously and older algorithms offer much weaker protection than current ones. Strongly hashed is doing real work in that sentence.
Why it matters
It lets you judge how worried to be from the detail rather than the headline count.
Try this today
When a service you use is breached, find out what fields were taken.
Test yourself
Two breaches are announced. One exposes 10 million records with strongly hashed passwords. The other exposes 5,000 with plain-text passwords and answers to security questions. Which is worse for those affected?
Show the answer
The second, comfortably. Strong hashing means the passwords are not directly usable, while plain text is immediate access, and security answers cannot be changed and are reused across services. Severity is set by the fields and their handling, not by the count.
Learn this in the feed Answering from memory, then again days later, is what makes it stick.