The email arrives with a subject line that is almost polite. A company you have an account with has found that attackers got into its systems, and some of the leaked customer data has since appeared on a public site. It does not say how much, or whose. You are left staring at the message wondering whether to panic or ignore it.
Neither is the right move. Here is how to think about it, starting with what the posting actually means.
Why attackers publish leaked customer data
Leaked customer data is usually about leverage. Many modern attacks involve extortion: the criminals copy files, demand payment, and threaten to publish if the company refuses. If the company holds out, or negotiations stall, the data goes on a leak site. Posting it also serves as advertising for the gang and a warning to future victims.
Once leaked customer data is public, it can be copied endlessly. Even if the original page is removed, mirrors and archives keep it alive. So the working assumption should be that anything in the breach is permanently available to anyone who looks.
First, find out what was exposed
The risk depends entirely on the type of data. A list of names and email addresses is an annoyance, since it feeds phishing. Passwords, even hashed ones, are worse. Payment details, government ID numbers, dates of birth and home addresses raise the stakes considerably.
Read the company’s notice carefully and look for the categories of data listed. If the notice is vague, check the company’s website or support page, and consider asking directly. Many jurisdictions require breached organisations to tell affected people what was taken. You can also look your email address up in a reputable breach-notification service such as Have I Been Pwned, which will show which known leaks include it.
What to do in the first hour
- Change the password on the affected account, and on any other account where you used the same or a similar one. Reuse is how a breach at one company becomes a breach everywhere.
- Use a password manager to make each password unique. If you do not have one, this is the week to start.
- Turn on multi-factor authentication, preferably with an authenticator app or a hardware key rather than text messages.
- Sign out of other sessions in the account settings, where the service offers it.
- Check your email’s forwarding rules and recovery options, in case someone has quietly altered them. If you want a fresh start, a private encrypted email account is worth considering.
If financial details were involved, watch your statements closely and tell your bank, which can reissue the card. If identity numbers or birth dates were exposed, consider a credit freeze, which in many countries is free and prevents new accounts being opened in your name. You can lift it temporarily when you need credit.
Expect phishing. People whose data has been leaked often receive messages that sound uncomfortably well informed, naming the company, quoting a real order or using their correct address. The messages may claim to offer compensation, free credit monitoring or urgent account verification. Do not click anything. Go to the company’s site by typing the address yourself, or call the number printed on your card. Our guide to the first 24 hours after a breach headline covers the same ground on a tighter timeline.
It helps to treat each type of exposed information differently. If only your email address leaked, the main risk is spam and phishing, so focus on filters and caution. If a password leaked and you reused it, change it everywhere today. If leaked customer data includes your phone number, expect text-message scams and be wary of any call claiming to be your bank, since criminals sometimes try to talk people into reading out a verification code. If it includes your home address, watch for fake delivery notices.
Keep a short record as you go: the date of the notice, which accounts you changed and whom you contacted. If the breach later turns into fraud, that log makes disputes with banks and agencies much faster. Leaked customer data tends to resurface, and a tidy record means you will not have to reconstruct what you did.
What you can ignore
Some advice is more noise than help. You do not need to delete every account you have. You do not need to pay a service that promises to scrub your data from the internet; it cannot, at least not reliably. And you do not need to feel foolish. People hand details to companies every day, and the failure was the company’s security, not your trust.
Be cautious, too, about messages from strangers claiming to have your leaked customer data and offering to delete it for a fee. That is a second scam layered over the first.
The question for the company
Customers are right to ask more than what happened. Was the data encrypted? How long was it retained, and why was old data still on the system? How did the attackers get in, and how quickly was it detected? A prompt, plain-spoken notice about the leaked customer data is a decent sign. A slow, defensive one tells you something too, and it may help you decide whether to keep the account.
Large breaches have a long tail. Data sets are traded, combined and reused for years. The practical answer is to make your accounts resilient enough that any single leak matters less: unique passwords, strong authentication, a frozen credit file and a suspicious eye. Do those four things, and the next alarming email becomes a ten-minute chore instead of a worry.
Image: Watty62 / Wikimedia Commons, CC BY-SA 4.0.
