Skip to content

What happens to your address when a shop is breached

BlogGuide

What happens to your address when a shop is breached

Share

A shop you bought from four years ago gets breached. You may hear about it from a news article, or not at all. Here is what tends to happen to your address, and what changes if the shop only had an alias.

In short

  • Breaches are often found late. IBM's 2025 report gives a mean of 241 days to identify and contain one.[1]
  • Stolen data is combined with other breaches, so an address that appears in several joins the records together.[2]
  • An alias does not stop a breach. It shows who leaked the address, stops it matching other data, and can be switched off.
  • Passwords are where the damage happens. Change any you reused.

Create a free account

What happens after a breach

A timeline of a breach in three stages for a real address: unnoticed, combined with other breaches, then resold. Below it the same timeline with an alias, which is known to belong to one shop, matches nothing else, and can be switched off.
A timeline of a breach in three stages for a real address: unnoticed, combined with other breaches, then resold. Below it the same timeline with an alias, which is known to belong to one shop, matches nothing else, and can be switched off.

Unnoticed. IBM puts the mean time to identify and contain a breach at 241 days, the lowest in nine years.[1]

Combined. The best known example is Collection #1: 2,692,818,238 rows drawn from thousands of breaches.[2] Your address gets matched across them into a profile.

Resold. The address ends up in bulk lists with no trail back to the shop.

Using stolen credentials to log in is called credential stuffing. OWASP defines it as "the automated injection of stolen username and password pairs ('credentials') in to website login forms, in order to fraudulently gain access to user accounts."[3]

What an alias changes

Item Your real address An alias for that shop
Who leaked it Unknown That one shop
Matching across breaches Records join on the address Nothing to join
Ending the mail Not possible Switch the alias off
What the shop still has Name, delivery address, card digits The same

The day you find out

  1. Change reused passwords first. NIST asks services to check new passwords against compromised lists, and a reused one is the kind that appears there.[4]
  2. Check what the address was used for. If it was an alias, switch it off, or keep it and accept the noise.
  3. If it was your real address, use a different one for the next shop.

Have I Been Pwned lets you search an address against known breaches and sign up for alerts.[5]

The claim is small on purpose

Aliases do not prevent breaches or make you anonymous. They make you hard to join across datasets. Setting it up is in email aliases for online shopping.

Sources

All checked on 20 September 2026.

  1. IBM, Cost of a Data Breach Report 2025 (mean of 241 days to identify and contain a breach): https://www.ibm.com/think/x-force/2025-cost-of-a-data-breach-navigating-ai ↑
  2. Troy Hunt, The 773 Million Record "Collection #1" Data Breach: https://www.troyhunt.com/the-773-million-record-collection-1-data-reach/ ↑
  3. OWASP Community, Credential stuffing: https://community.owasp.org/attacks/Credential_stuffing ↑
  4. NIST, SP 800-63B-4, Digital Identity Guidelines, Authentication and Authenticator Management (blocklist of compromised passwords): https://pages.nist.gov/800-63-4/sp800-63b.html ↑
  5. Have I Been Pwned: https://haveibeenpwned.com/ ↑