Reviews
Data breach, credential stuffing, phishing, malware, SIM swap: telling them apart
Data breach, credential stuffing, phishing, malware and SIM swap compared by kind and evidence, so each incident gets the right label before anyone responds.
What to take away
- These terms sort into events, methods and harms, and one incident can involve all three.
- Name the type from the evidence you hold, not from the worst outcome you fear.
- A breach notice does not prove fraud, lost phone service does not prove a SIM swap, and a login alert does not prove phishing.
- Credential stuffing depends on reused passwords, which separates it from password spraying and brute force.
- Preserve observed facts before labeling an attacker, method, or victim impact.
A person may receive a breach notice, then a phishing message, then a login alert caused by password reuse. Calling all three events a hack obscures which control failed and which response is needed.
Event, method or harm
Sort each term into one of three kinds before comparing them. A breach is an event at an organization. Credential stuffing, phishing, malware and SIM swap are methods. Doxxing and identity theft are harms. Mixing the kinds is how a notice gets called a theft.
| Term | Kind | What it describes |
|---|---|---|
| Data breach | Event | Unauthorized exposure controlled by an organization |
| Credential stuffing | Method | Reused stolen credentials tested on another service |
| Phishing | Method | A deceptive attempt to obtain data, money, or access |
| Malware | Method | Software that performs harmful or unwanted actions |
| SIM swap or port-out fraud | Method | Phone service moved under unauthorized control |
| Doxxing | Harm | Personal information gathered and released or used maliciously |
| Identity theft | Harm | Identifying data used without authority |
One incident can lead to another, but the first does not prove the second occurred. A harm may follow an event or a method, and the order alone never shows that it did.
What the evidence can and cannot show
Each type leaves different evidence, and one observation rarely settles the label. Match what you hold to the type it supports, and note what it does not prove before you write the label down.
Incident Types at a Glance
Data breach
- What it is
- Org data exposed
- Evidence
- Notice, scope, fields
- First response
- Verify, protect data
Credential stuffing
- What it is
- Reused logins tested
- Evidence
- Login records, reuse
- First response
- Unique passwords, MFA
Phishing
- What it is
- Deceptive data grab
- Evidence
- Message, URL, headers
- First response
- Stop contact, protect
| What you hold | Type it supports | What it does not prove |
|---|---|---|
| A notice with scope, dates and affected fields | Data breach | Fraud downstream of the exposure |
| A provider alert, login records and known reuse | Credential stuffing | That the service named in a breach was the only account tried |
| A message, URL, headers or submitted information | Phishing | That anything was opened or supplied |
| A trusted scan, process, file or forensic finding | Malware | Anything, if you hold only a pop-up or a slow computer |
| Lost service, carrier records, a SIM or port notice | SIM swap | Fraud, if the carrier shows an outage or device fault |
| A new account, transaction, filing, benefit or record you did not make | Identity theft | Anything from exposure alone |
| Copies, URLs, timestamps and threats | Doxxing | Where the material came from |
Credential stuffing, password spraying and brute force
Credential stuffing uses username and password pairs obtained elsewhere against another service, so it depends on password reuse. It differs from password spraying, which tries a small set of common passwords across many accounts, and from brute force, which attempts possible values.
CISA's identity and access management practices describes credential stuffing, password spraying, phishing, brute force, and the role of multifactor authentication, including phishing-resistant methods. The publication is written for administrators; it does not diagnose a consumer login alert.
Because the method depends on reuse, the control that failed is the password. Enabling the strongest practical authentication addresses that failure, and a breach elsewhere does not mean the service named in the notice was the only one tried.
Phishing is deception, not a synonym for hacking
Phishing is deception. It may imitate a provider, coworker, friend, government office, delivery service, or security notice, and the requested action can be a login, verification code, payment, attachment, remote-access installation, or reply with personal data.
Whether it succeeded depends on what was supplied. If nothing was opened or supplied, the message is evidence of an attempt only. If credentials, codes, money, or device access were given, the label has to describe what followed as well.
Malware is software, not every symptom
Malware is software that performs harmful or unwanted actions, not every unwanted pop-up or slow computer. Symptoms can justify caution, but a trustworthy scan, technical assessment, or forensic evidence provides a firmer conclusion.
Until one of those exists, treat the label as unproven and the device as suspect. Stop entering credentials on it, and follow organizational evidence rules if the device belongs to an employer.
SIM swap compared with a service outage
In a SIM swap, mobile service is transferred to another SIM under unauthorized control. Port-out fraud moves the number to another carrier account. Both can interrupt calls and texts and expose accounts that use the number for recovery.
The FCC's SIM swap and port-out proceeding describes those mechanisms and the risk to phone-based authentication. It is a regulatory proposal and record, not a finding that a particular outage is fraud.
Lost service alone does not separate the cases. A network outage or damaged phone can also stop service, so obtain carrier evidence before calling it fraud. The risk to accounts is real either way, which is why authentication methods compared treats SMS codes separately, and why a recovery and alert checklist covers the number.
Harms: identity theft and doxxing
Identity theft is unauthorized use of identifying information, such as opening an account, filing a return, claiming benefits, getting medical care, or making a purchase. Exposure alone is not the same as use, so a breach notice on its own is not identity theft.
Doxxing involves personal information gathered and released or used maliciously. Material can come from public records, social posts, brokers, stolen data, or inference. Harm may involve harassment, false reports, stalking, or threats.
Reducing what brokers hold is its own task, and a data broker opt-out checklist covers it. Where a threat is credible, personal safety comes before any label.
Common questions
Is every account takeover caused by phishing?
No. Reused credentials, malware, recovery abuse, stolen sessions, insider access, and other methods are possible.
Does a breach notice prove identity theft?
No. It establishes or reports exposure under the organization's findings. Identity theft requires unauthorized use of identity data.
Does lost phone service prove a SIM swap?
No. Contact the carrier to distinguish account changes from outages, device faults, and service problems.
Is doxxing limited to publishing a home address?
No. It can involve other identifying information gathered and released or used maliciously.
