How to find out if you are involved in a data breach — and what to do next

According to IBM, the most common initial attack vector cyberattackers use to break into a company’s network is the use of compromised credentials, an approach that is responsible for 20% of breaches. 

These credentials can include account usernames and passwords leaked online, stolen in a separate security incident, or obtained through brute-force attacks, in which automatic scripts try out different combinations to crack easy-to-guess passwords. 

Other potential attack methods are:

The attacker may conduct surveillance first, mapping a network to work out where the most valuable resources are — or to discover potential pathways to jump into other systems.

Verizon says that 71% of data-related incidents are financially motivated. Attackers may deploy ransomware to blackmail their victims into paying up to regain their access to the network. In so-called “double-extortion” tactics, hacking groups may first steal confidential information and then threaten to leak it online. 

Alternatively, some may grab and go, stealing the intellectual property they came for and then erasing their tracks. Others may test their access point and sell it to other cyberattackers via the dark web. 

In some cases, network intrusions are for one reason alone: to disrupt services and damage a company. 

Some miscreants download data and make these data dumps freely available online, posting them to resources such as PasteBin.

The internet as a system can be divided into three layers: the clear, the deep, and the dark web. 

• The clear web: The clear web is the internet most of us use on a daily basis. Millions of websites and pages are indexed by search engines, and you can access them from a typical browser, such as Safari, Chrome, or Firefox.

• The deep web: The deep web is the layer underneath, which requires a specific browser to access. The Tor network and a VPN are typically required. Websites are indexed using .onion addresses, and the entire network is based on the principles of security and anonymity. This helps in legal applications — such as circumventing censorship — as well as illegal operations. 

• The dark web: The dark web is the next layer down and is an area that is associated with criminal activity. This can include the sale of information, illegal products, drugs, weapons, and other illicit material. 

The terms dark and deep web can be used interchangeably.

If you’ve been involved in a data breach as a user or customer, your records may have also been exposed, stolen, or leaked online, as in the cases below: 

• Securitas: In January, researchers disclosed unsecured AWS buckets belonging to the security company, left exposed online. Airport employee records and PII were leaked. 

• Shanghai National Police (SHGA) database: In July, reports suggested that data collected by SHGA, impacting approximately 1 billion Chinese citizens, was spotted for sale on the Dark Web. 

• Robinhood: A 2021 security incident resulted in the personal information and email addresses of roughly 5 million people being stolen. 

• Facebook: A data dump including information belonging to 553 million Facebook users was released online in 2021, two years after being harvested. 

• Volkswagen, Audi: Last year, the companies admitted to a data breach impacting 3.3 million customers and interested buyers.

Your personally identifiable information (PII), including your name, physical address, email address, work history, telephone number, gender, and copies of documents including passports and driving licenses, can all be used to conduct identity theft. 

ID theft is when someone uses your information without permission to pretend to be you. They may use your identity or financial data to conduct fraud and commit crimes. This can include tax-related fraud, opening up lines of credit and loans in your name, medical fraud, and making fraudulent purchases online.

Criminals may also ring up a company you use, such as a telecoms provider, and pretend to be you to dupe customer representatives into revealing information or making changes to a service, such as in the case of SIM-swapping attacks.

These scenarios can impact your credit score, make you financially responsible for a loan or payment you didn’t agree to, and lead to serious stress and anxiety in cleaning up your name and finances. As cybercrime is global, it can also be extremely difficult for law enforcement to prosecute the perpetrators. 

Blackmail, too, can be a factor. When extramarital affairs website Ashley Madison experienced a data breach in 2015, some users were contacted by cybercriminals threatening to tell their partners, friends, and colleagues about their activities unless they were paid.

Typically, your service provider will contact you through email or letters, explaining that your information has been compromised. However, companies may take weeks or months to contact you — if at all. 

Therefore, it is also up to you to keep an eye on the news for any recently disclosed data breaches, and there are also handy tools available that you can take advantage of:

What you do next depends on the severity and type of data breach. The likelihood is that you have already had your PII leaked in some form or another online regarding basic details — such as your name and email address. In this scenario, there is not much you can do. 

However, if your online account details have been compromised, whether or not the password is hashed, you should change it immediately. In addition, if you are guilty (as many of us are) of reusing password combinations across different platforms and services, you should also change them at once. 

If you use a password locker or manager, these platforms will usually warn you if the same passwords are being used across multiple services. 

Whenever you can, enable two-factor authentication (2FA). Two-factor authentication implements a second layer of security on your accounts, so if your credentials have been leaked, attackers would also need access to your email account or handset to grab the verification code required to access your account. 

It would help if you also considered using a physical YubiKey security key for any central “hub” accounts, such as your Gmail or Microsoft email address. If an attacker manages to steal the credentials for these accounts, this can grant them the keys to your entire digital kingdom. But without access to the physical key, attackers are stopped in their tracks.