Scams That Follow a Data Breach
After a company announces a data breach, scammers follow with fake compensation offers, fake security alerts and targeted phishing. How data breach scams work and what to do.
When a company announces a data breach, the leaked data is only the first problem. The second is the wave of scams that follows. Criminals know people are worried and expecting to hear from the company, so they send fake breach notices, fake compensation offers and fake security alerts. They also use the leaked details themselves to make their messages more convincing.
How scammers exploit breaches
- Breach-themed phishing: "Your account was affected. Reset your password here," linking to a fake login page.
- Fake compensation: "You are entitled to a payout. Enter your bank details to claim."
- Fake identity protection: offers of paid monitoring that simply collect card details.
- Targeted scams: calls and messages that use your real details from the breach, such as your account number or last order, to seem genuine.
- Password reuse attacks: leaked passwords tried on other accounts, such as email and banking.
- Sextortion bluffs: emails quoting an old leaked password and claiming to have hacked your webcam. See sextortion: what to do.
A message that knows your details is not proof it is genuine. After a breach, criminals may know a lot about you. Judge the request, not the details.
Illustrative example
hxxps://customer-compensation-claims[.]com- Real details (name, order dates) used to build trust.
- A compensation offer requiring bank details via a link.
- A domain that is not the company's.
What to do after a breach
- Get information from the source: read the company's breach notice on its official website or app.
- Change the password for that account, and anywhere you reused it. A password manager makes this easier.
- Turn on two-step verification, especially for email and banking.
- Check whether your details appear in known breaches using a service such as Have I Been Pwned.
- Watch statements for unfamiliar charges.
- Consider a credit freeze or fraud alert if ID numbers or dates of birth were leaked, where your country offers them.
- Be extra careful with messages for months afterwards, especially ones about the breach.
Genuine breach notifications usually
- explain what happened and what data was involved
- tell you to reset your password through the normal app or website
- offer help through official channels
- do not ask for your password, full card number or bank login by email or phone
Received a breach notice or compensation offer? Paste it into CyberWatch AI Scan for a free check.
For more on breaches and account protection, see our identity theft and account security guide. For more scams, read the complete guide to online scams.
Frequently asked questions
How do scammers use leaked data?
To make messages more convincing, using your real name, address, account number or recent purchases, and to try leaked passwords on other accounts.
Is an email about a breach from the company real?
It may be, but do not use its links. Check the company's official website or app for its breach notice, and follow the steps there.
How can I check if my email was in a breach?
Services such as Have I Been Pwned let you check whether your email address or phone number appears in known breaches.
Sources
- Have I Been Pwned, Troy Hunt
- Credit Freezes and Fraud Alerts, US Federal Trade Commission
- What To Know About Identity Theft, US Federal Trade Commission
