A notice saying 'your details may have been exposed' surprises no one anymore. In the past week alone, SEGA and hundreds of other companies said customers' email addresses leaked through a Japanese email vendor, and a French bank lost more than $100 million in a breach through an outside vendor. The common mistake is to ignore the notice, or the opposite, to panic and do the wrong things. Here is what really matters.
Step one: understand what leaked. Read the notice carefully. An email address alone is a relatively low risk, and the main danger is phishing. If your name, phone and address leaked too, the risk of convincing impersonation messages rises. If passwords leaked, even hashed, or card details, act right away. And check that the notice itself is real: attackers sometimes send a 'breach notice' to get you to click a link.
Step two: if a password leaked, change it, and on every other site where you used the same password. This is where most people fall: the attacker does not need your account on the breached site, they try the same password on Gmail, your bank and Facebook. A password manager solves this for good. And on every important account, turn on two-factor authentication, preferably with an app rather than an SMS.
Step three: if card details leaked, call the card issuer, ask to block the card and issue a new one, and watch your charges over the coming months. In Israel you can also set up alerts for every transaction in your card issuer's app, the most effective tool for spotting unauthorized use quickly.
Step four, and the most important: be careful in the weeks after. Most damage from leaks comes not from the leak itself but from the phishing messages that follow. An email or SMS 'from the company' that uses your name and asks you to verify details, pay a fee or 'update a payment method' is almost always a scam. Don't click the link. Go to the website or app directly.
Step five: check where else you are exposed. The Have I Been Pwned site lets you check which known breaches your email address appeared in. And in the long run, consider using a separate email address for signing up to newsletters and promotions. That way, when some email vendor is breached, and it will be, the leaked address will not be the one connected to your bank.
