In more detail
Causes include hacking, stolen credentials, misconfigured storage, lost devices and insider mistakes. Many privacy laws require affected organisations to notify regulators and people within a set time. If your details are exposed, change the password anywhere you reused it, turn on Multi-factor authentication (MFA) and watch for Phishing that uses the leaked data. Under the EU GDPR, for example, a breach that risks people's rights must be reported to the supervisory authority within 72 hours of the organisation becoming aware of it, where feasible.
Why it matters
Leaked email and password pairs are fed into automated login attempts on other sites within days, so one breach at a small forum can open a reused password at your bank. Leaked personal details also make phishing far more convincing. For organisations, a good response plan, logging and a published contact (such as a security.txt file) shorten the time from discovery to containment.
Example
Checking whether a password appears in known breaches without revealing it, as the Pwned Passwords range service does (k-anonymity):
SHA-1("password") = 5BAA61E4C9B93F3F0682250B6CF8331B7EE68FD8
send only: 5BAA6
compare locally: 1E4C9B93F3F0682250B6CF8331B7EE68FD8
The service returns every hash suffix starting with 5BAA6, and the match is found on your own device. Publish your disclosure contact with the security.txt Generator.