The email arrives from a company you've used. It says there's been a security incident. Or you type your address into a breach-checking site and see a list of names you'd half forgotten.
It feels like the damage has been done. Usually, it hasn't. Not yet.
What a breach actually gives criminals
The UK's National Cyber Security Centre defines a data breach simply: information held by an organisation is stolen or accessed without authorisation.
What happens next is the part to watch. Criminals use what they stole to make phishing messages look legitimate. Your name, your order history, the service you use. Some go further and pretend to be the very organisation that was breached, because you're already expecting to hear from it.
Our reading: the breach is the setup. The scam message is the attack. Which means the most important thing you can do is not be fooled by the follow-up.
What to do, in order
1. Confirm it the safe way. Go to the company through its official website or social media, not the links in any message. It should tell you what was taken.
2. Fix your passwords. If the leaked password is one you still use, change it. Then change it everywhere you reused it. This is the step that matters most, because criminals try leaked passwords on other sites.
3. Turn on stronger sign-in. Add two-step verification, or a passkey where offered, on your email and money accounts.
4. Check for signs of trouble. Look for logins from strange locations or at unusual times, changed security settings, or messages you didn't send.
5. See what else is out there. Tools such as Have I Been Pwned show whether your email appears in other public breaches.
The messages to expect
For weeks or months afterwards, treat these with suspicion:
- A message about the breach asking you to log in or verify your account
- An offer of compensation that needs your bank details
- A call from someone who already knows a few things about you
Knowing your name or your last order doesn't make a caller genuine. After a breach, that information may be exactly what was stolen.
If you lost money
Tell your bank immediately, and report it. Our guide to the next hour after money leaves your account explains the reporting steps in India and what the rules say about refunds.