Your Details in a Data Breach: What to Do Next

When an organisation tells you, or the news reports, that personal data has been stolen, the first thing to do is find out whether you are actually affected. The National Cyber Security Centre (NCSC) advises contacting the organisation through its official website or social media channels, and never using the links or contact details in any message you have been sent about the breach¹. A data breach occurs when information held by an organisation is stolen or accessed without authorisation², and the follow-up work for you falls into three parts: checking your accounts, changing any passwords that may have been exposed, and staying alert to scam messages that use the stolen details to look genuine³.

Most people who are caught up in a breach come to no harm, but the details can be used against you for months afterwards. Criminals use stolen information in scam emails and text messages so that they appear legitimate³, and they exploit high-profile breaches even if your own details were not stolen, while the story is still fresh in people's minds². Your bank, and any other official organisation, will never ask you to supply personal information in response to a message⁴. If you lose money, tell your bank and report it as a crime to Action Fraud at actionfraud.police.uk, the UK's reporting centre for cyber crime; in Scotland, contact the police by dialling 101³.

Check whether you have been affected, safely

Start with the organisation that was breached. The NCSC's advice is to find out if you have been affected by contacting the organisation using its official website or social media channels¹. Type the organisation's web address into your browser yourself, or use a phone number you already have from a letter, statement or card. Do not click through from an email or text, however convincing it looks, because the NCSC warns specifically not to use the links or contact details in any messages you have been sent¹.

You can also check whether your details have appeared in public data breaches using online tools. The NCSC points to services such as haveibeenpwned.com, and notes that similar checks are often included in antivirus or password manager tools². These services let you enter an email address and see which known breaches it appears in, which is useful for finding out about older breaches you may never have been told about. Our page on how to check if your email was in a breach walks through this step by step.

If you would rather speak to someone, you can phone the organisation directly, but the NCSC cautions that many organisations will not have the capacity to respond to all calls during a major breach². A phone queue is not a sign of a cover-up; it is a sign that thousands of other people are asking the same question. Keep an eye on the official website and social media channels instead, where updates are usually published first.

What a data breach is, and what it can expose

A data breach occurs when information held by an organisation is stolen or accessed without authorisation³. In practice this means unauthorised access to sensitive data stored by organisations, including councils, hospitals and businesses⁵. The information exposed can be personal, financial or organisational, and can lead to reputational and financial damage for the organisation and to identity theft for the people whose records were taken⁵. Personal data breaches can also have legal consequences for the organisation under the General Data Protection Regulation⁵.

The NCSC defines a cyber incident more broadly as a breach of a system's security policy in order to affect its integrity or availability, or the unauthorised or attempted access to a system, in line with the Computer Misuse Act 1990⁶. Commonly recognised breaches include attempts to gain unauthorised access to a system or data, the unauthorised use of systems for processing or storing data, changes to a system's firmware, software or hardware without the owner's consent, and malicious disruption or denial of service⁶. A data breach is one form of this: the attackers' aim is the information itself, whether they copy it, leak it or hold it to ransom. Our page on ransomware explains how that related attack works.

What this means for you depends on what the organisation held. A retailer may have lost your name, address and order history; a council may have held benefit and council tax information; a health board holds clinical records. The more sensitive the data, the more carefully you should watch the accounts and services linked to it. The NCSC's guidance for individuals and families sets out the practical actions to take following a breach, and the sections below follow that order⁴.

Breached details make scam messages look genuine

The most likely way a breach affects you is not a direct raid on your bank account but a message that arrives afterwards. Criminals use stolen information within scam emails and text messages so that they appear legitimate, and may pretend to be from an organisation that has suffered a recent data breach³. They can quote your real name, address or account details, which makes the message far more convincing than a generic scam.

The NCSC warns that criminals exploit high-profile breaches even if your details were not stolen, while they are still fresh in people's minds². So after any widely reported breach, expect a wave of messages that reference it. These scam messages typically contain links to websites that look genuine but store your real details once you have typed them in, install viruses, or steal any passwords you enter². The NCSC's list of things to look out for includes official-sounding messages about "resetting passwords", "receiving compensation", "scanning devices" or "missed deliveries", emails full of "tech speak", and being urged to act immediately or within a limited timeframe².

If the stolen information includes phone numbers, the approach may be more direct: a suspicious call asking you for sensitive information such as banking details or passwords, or for access to your computer⁴. Criminals also use information about you that is available online, including on social media sites, to make their phishing messages more convincing⁷. Our page on how to spot scam messages after a data breach goes into more detail.

Breached details can also be used directly against you. NHS Dumfries and Galloway, whose systems were attacked, advises everyone to be cautious regarding their own online activity because stolen information could be used in an attack⁸. Treat unexpected messages that reference your real details with suspicion, even when they appear to come from an organisation you trust.

One common trick is the fake missed parcel text. The NCSC advises: do not click the link in the message, and do not install any apps if prompted⁹. If installed, this malware can steal your banking details, passwords and other sensitive information, and attempts to access your contact list to send scam SMS messages to those numbers as well¹⁰. If you have logged into any accounts or apps since installing such malware, you must change the password for that account, and update the same password on any other accounts, making sure they are unique¹⁰. Our page on FluBot and fake parcel texts covers this scam in full.

Your bank will never ask you to supply personal information

This rule is the single best defence against the scams that follow a breach. The NCSC repeats it in its guidance for individuals and families: be alert to suspicious messages, which may be sent some time after the breach is made public, and remember that your bank or any other official organisation will never ask you to supply personal information⁴. The delay matters. A breach announced in one month can produce convincing scam messages in the next, when your guard is down and the story has faded from the news.

If you have any doubts about a message, contact the organisation directly using details from their official website, not the numbers or address in the message¹¹. The same applies to calls: if someone phones claiming to be from your bank, hang up and call the bank back on the number printed on your card. If you have received a suspicious call or message pretending to be your bank, do not use the contact details provided and do not click on any links you are sent¹³. If you have already provided your banking details to a scammer, contact your bank and let them know straight away⁷. Our pages on how to check a message from your bank is genuine and gave your bank details to a scammer set out what to do.

Signs your accounts are being misused

After a breach, check your online accounts for unauthorised activity. The NCSC lists the signs to look out for: changes to your security settings, messages or notifications sent from your account that you do not recognise, logins or attempted logins from strange locations or at unusual times, and unauthorised money transfers or purchases¹⁴. You may also find you cannot log into your accounts at all, which can mean somebody else has changed your password¹. Check bank statements and online store accounts for unauthorised purchases and unusual transactions, and contact your bank directly using contact details from their official website or social media channels¹⁵.

Work through these checks in order:

1. Try to log in to each account linked to the breached organisation. Not being able to log into your accounts is one of the things to look out for after a breach¹.
2. Review security settings. Look for changes to your security settings that you did not make yourself¹⁴.
3. Check sent messages and notifications. Anything sent from your account that you did not send is a warning sign¹⁴.
4. Review login history. Look for logins from strange locations or at unusual times¹⁴.
5. Check bank statements and online store accounts for unauthorised purchases and unusual transactions¹⁵.
6. If a suspicious message includes a password you still use, change it as soon as you can, change it on any other accounts using the same password, and consider using a passkey instead².

If you suspect an account has been accessed, follow the NCSC guidance on recovering a hacked account². The NCSC also suggests reading that guidance in advance, so you know what to do if you experience an incident¹⁶. The recovery steps include changing your password, checking for changes the attacker may have made, and applying updates to your apps and device software as soon as they are available, because updates include protection from viruses¹⁴. Once you have secured the account, notify your contacts, friends or followers that you were hacked, and suggest they treat recent messages from your account with suspicion¹⁷. Our page on what to do if an online account is hacked covers the full process.

When a health board or council is breached

Attacks on public services show what a breach looks like at scale, and why the disruption can outlast the headlines. NHS Dumfries and Galloway was hit by a cyber attack in which some information was copied from its systems and leaked, while the health board still holds the original files, which have not been altered or deleted¹⁶. Careful checks of its systems, carried out with other agencies, give the health board confidence that patient records have not been tampered with¹⁶. The point matters for patients: data being copied and published is a privacy problem, but it does not mean your medical record has been altered.

The practical advice for patients in that position is straightforward. Unless you have been specifically told otherwise, assume consultations, tests, referrals, scheduled treatments and other appointments will happen as normal¹⁶. NHS Dumfries and Galloway has contacted everyone whose information is known to have been leaked¹⁶. Because stolen information could be used in an attack, everyone should be cautious regarding their own online activity¹⁶. Further information and updates are published at nhsdg.co.uk/cyberattack, and the health board asks people to check back frequently¹⁶. Our pages on the Synnovis incident and NHS appointments during an IT outage go deeper.

Councils have fared similarly. Gloucester City Council was the subject of a targeted ransomware attack in December 2021 which encrypted its servers and temporarily prevented the council from providing services which relied on the data held on those servers¹⁸. Hackney Council experienced a major ransomware attack in October 2020 which disrupted council services for months and cost over £12 million through lost income and attempts to restore and strengthen IT systems¹⁹. Redcar and Cleveland Borough Council fell victim to a ransomware attack in February 2020 which kept it offline for almost a week and caused significant data loss¹⁹. The Local Government Association has identified ransomware as the number one cyber security risk to councils¹⁹.

The pattern to take from these examples is duration. A committee reviewing ransomware found many organisations taking months to recover²¹, so a breach that makes the news for a week can affect appointments, payments and services for far longer. Keep a note of what the organisation tells you, check its official channels periodically, and be patient with services that are working from paper or reduced systems. Our page on council online services down explains what help is available meanwhile.

Where to find updates, and how to complain or report

Official websites and social media channels are the places to watch. The NCSC advises finding out if you have been affected by contacting the organisation using its official website or social media channels¹, and a review of a major service disruption recommended that organisations use social media platforms to share updates with the public, with guidelines on the frequency and timeliness of those updates²². Verify that an account really belongs to the organisation before trusting it, because criminals copy real accounts and posts to lend their fakes credibility.

If a message or call about a security breach does not feel right, report it. Suspicious emails can be reported through the NCSC's reporting service, and the government advises not giving out private information such as bank details or passwords, not replying to suspicious text messages, not downloading attachments and not clicking on links in emails if you are not sure they are genuine²³. Do not click on any links in a suspicious email²⁴. If you received the message on a work laptop or phone, contact your IT department and tell them what has happened²⁵. Our pages on how to report a phishing email and how to report a scam text give the exact steps.

If you have lost money, tell your bank and report it as a crime to Action Fraud at actionfraud.police.uk, the UK's reporting centre for cyber crime; in Scotland, contact the police by dialling 101³. If you have provided your banking details to a scammer, contact your bank and let them know⁷. Organisations themselves report cyber incidents at gov.uk/report-cyber¹⁵, which is one reason details can be limited while police and law enforcement investigations are under way: expect published updates rather than full answers, and keep your own record of what was said and when.

Finally, keep your own defences in good order so that a leaked password alone is not enough to harm you. Apply updates to your apps and device software as soon as they are available, because updates include protection from viruses¹⁴. Use a different password for each important account, and consider two-step verification on your email and banking accounts: our page on protecting email and bank accounts explains how. If you want a broader plan, our home online security checklist is a good place to start.