Have you ever received an email informing you that your personal data may have been leaked after a cyberattack on a company or service you use?
Once upon a time, receiving a notification that your personal data had been breached was rare. Today, it has become almost a daily occurrence. In the US alone, 3.322 incidents of personal data breaches were reported last year, resulting in 280 million victims receiving a related email notification. In Europe, daily incidents increased by 22% year-on-year in 2025, reaching an average of 443 breaches per day.
Because these types of email alerts have become common, scammers know that people won't be surprised to receive them and therefore won't necessarily consider them suspicious. So when criminals send a fake message, someone is more likely to believe it's genuine and do what it says.
"To be clear: real data breaches happen every day and a genuine alert should not be ignored, because there may indeed be a real risk. The important thing is not to act mechanically, but to carefully check whether the message is real or fake," explains Phil Muncaster from global cybersecurity company ESET.
So, let's take some time to familiarize ourselves with data breach scams and be better prepared the next time such a notification appears in our email.
What do fake data breach notification scams look like?
There are two basic tactics that apply in these cases:
- Scammers wait for a real data breach to occur and take advantage of the publicity surrounding the incident to send out fake alerts. In this scenario, victims are more likely to believe the scam, as they may actually be expecting to receive some official update.
- Scammers fabricate a non-existent breach and create a fake notification that includes details about the alleged incident. Often, the message appears to be sent by a well-known and trusted company, making it seem relevant and credible to the recipient. However, scammers may also pretend to represent the IT department of the organization or company where the victim works.
In both cases, fraudsters are increasingly using phishing kits and artificial intelligence (AI) tools to automate and refine the creation of fake alerts. AI is particularly effective at creating deceptive messages that appear authentic, as it can use the language of the recipient and copy the wording, style and tone of real alerts. In addition, relevant logos and corporate identity elements are often used to further enhance the credibility of the message.
All of this can be created in minutes, allowing for the rapid sending of fake email alerts on a large scale immediately after an incident.
The ultimate goal of scammers is to trick you into clicking on a malicious link or opening a dangerous attachment, which may install information-stealing malware. Alternatively, they may seek to gain access to your personal or financial data, as well as your passwords.
These are the warning signs
Fake data breach alerts can often be easily spotted, as long as you know what to look out for.
Pay special attention to the following warning signs:
- Demand for immediate action: Scammers often use social engineering techniques to trick you into revealing personal information or clicking on a malicious link. They usually create a sense of urgency, claiming that your data is at risk if you don’t immediately update your password or verify your personal information.
- Suspicious email sender address: Scammers often try to spoof the sender's email address to make it appear to come from a reputable organization. For this reason, check carefully for typos in the name or email address, a common technique known as typosquatting. Also, hover over the display name, as it may be hiding an unrelated or suspicious sending domain.
- Poor spelling and grammar: While this sign is becoming less obvious as more cybercriminals use genetic artificial intelligence (GenAI) tools to improve phishing campaigns, it's still a useful first check to make.
- Suspicious links and attachments: Many of these messages contain links to phishing websites, which are designed to steal personal, financial, or login information. They may also include attachments that appear to be official notifications but actually install malware on your device.
- Lack of specific information: If you receive a legitimate notification from a company that has suffered a data breach, it will usually include some of your personal information, such as part of your account number or username. In contrast, scammers often lack this information, so their messages are general, vague, and lacking in specific details.
Stay safe
If something seems suspicious, don't rush into making decisions about your next steps. Take a moment to calm down and assess the situation calmly, emphasizes ESET's Muncaster.
If you receive such a notification, always verify its validity directly with the source, not by replying to the sender or using the contact information listed on the notification itself. Log in to your official account or contact the company via the official contact information to confirm whether the breach is real.
Identity protection features often included in reputable security software, as well as services like Have I Been Pwned, can be an additional way to check if your personal information has been compromised.
Reduce your risk even further by using strong, unique passwords stored in a password manager, combined with multi-factor authentication (MFA). This way, even if hackers get your credentials, they won't be able to easily access your accounts.
Finally, make sure you’re using strong email protection from a reputable provider. Ideally, this will leverage artificial intelligence to detect and block phishing and malware attempts.
What to do if you have already fallen victim to fraud
If you believe you have already been a victim of fraud, it is important to act immediately. Follow these steps:
- Change any passwords that may have been exposed, especially if you use the same password on multiple websites or apps. A password manager can help you create and store strong, unique passwords for each account.
- Enable Multi-Factor Authentication (MFA) on all your important accounts. That way, even if someone gets your password, they won't be able to easily gain access.
- Scan for malware using reputable security software.
- If you have shared banking or other financial information, contact your bank immediately. Consider temporarily blocking or replacing your credit and debit cards.
- Closely monitor your bank account movements for any suspicious transactions.
- Report the incident to the appropriate authorities.
As data breach alerts become more frequent, there is a risk that we will react mechanically and assume that every alert that ends up in our inbox is real. However, we must carefully evaluate such messages. Because this way we protect ourselves from potential scams and at the same time we can recognize the truly important and genuine security alerts in a timely manner.
Although the press releases will range from very select to rare, I said I'd pass...because sometimes the editors hide.
