What it means
A breach notice may say an attacker obtained a name, password hash or identity number. That does not automatically mean someone opened an account or spent money as the affected person. The difference affects urgency and evidence, but exposure can justify preventive steps before misuse appears.
A real-world example
An email address and password hash appear in a confirmed breach; the person changes a reused password, while a credit review shows no unfamiliar account.
What to do
Verify the notice independently, map each exposed field to an action and watch relevant accounts. Report actual misuse through the institution and official identity-theft process.
The distinction that matters
Credit monitoring can alert to some new credit activity but does not stop every form of fraud. A password reset protects an account but cannot change a permanent identity number. The FTC recommends tailored recovery based on what data was exposed.
FTC breach triage
