Publicly reported data breaches hit an all-time high in the US last year, with over 3,300 incidents recorded and nearly 280 million victim notices mailed out. But are all of these worth the paper they’re written on? Increasingly, they lack crucial details.
As the volume of data breach incidents increases, there’s a growing chance that you’ll be caught up in one. According to the non-profit Identity Theft Resource Center (ITRC), over 471 million victim notices went out in the first half of 2026 alone. Yet just a quarter (24%) contained details about the attack vector. That’s the lowest ever rate recorded by the ITRC.
This is bad news for consumers, corporate victims and policymakers. A lack of detail prevents you from understanding your true risk exposure or taking meaningful action to limit the fallout and possibly prevent it from happening again. ITRC’s own data shows that three-quarters of victims want a plain-language list of exactly what data was compromised.
Why are organizations cagey about releasing details?
There are many reasons why a breached entity might be reluctant, or unable, to share the full details of a breach incident. Crisis comms teams may want to get some information out to customers once news of an incident surfaces, to preserve reputation and prevent harmful speculation from mounting. But they may not yet know the full picture.
Information such as exactly what was compromised and how may take weeks or even months to establish, especially if it involves large data volumes. And if there’s a chance that broader disclosure could help other threat actors (by revealing the attack path and defensive weaknesses) or the adversary itself (if it is still inside the network) then it may be withheld.
There are also more financially driven motives for limiting disclosure. Excessive info-sharing might impact the share price, reputation, and/or competitive advantage of an organization.
The truth is that disclosures to regulators will usually feature far more detail. The victims, meanwhile, are often left grasping at straws.
How do you interpret a breach notice?
The language used in a breach notification can be confusing. If it says your data was “accessed” it doesn’t necessarily mean it was actually stolen (i.e., “exfiltrated”). And just because a breached company claims they have seen “no evidence of misuse” there’s absolutely no guarantee that this is true. What they see and what’s actually happening on the cybercrime underground can be two very different things.
Similarly, if a company says you “may have been affected” it doesn’t mean your data was definitely in the trove that was compromised – although it’s always best to err on the side of caution.
As mentioned, breach notices may be cagey about exactly how the hackers got in and stole the data (the attack vector). But for victims, this is one of the less important pieces of information. What you really need to know is:
- Whether your data was ‘only’ accessed or actually taken (although it’s best to assume the worst until you hear different)
- What data was taken, as this will determine your next steps (e.g., whether you need to reset passwords, call your bank, cancel cards etc)
- When the incident happened and how long it lasted, as this can help you to check against suspicious activity on affected accounts
- What the company itself is telling you to do in terms of specific next steps
Is the notification even legitimate?
It’s also important to check if the notice is genuine. Scammers have grown wise to the fact that breach notifications are an increasingly common occurrence. And something that recipients are likely to take notice of and act on.
For that reason, you should never click through on any unsolicited breach notification email or message. Sometimes the stated incident might never have happened. On other occasions the original breach might be real but the notification message is a scam.
In any case, your first port of call should be to check with the breached organization. Do this not by replying to the message or using contact details listed there, but verifying them elsewhere.
What should happen next?
Once you’ve confirmed the notification is legitimate, ask the organization involved if it can clarify any more details. Then consider the following steps, which are dependent on the type of data that may have been compromised:
- For personal details like email and home address, name and phone number, be on the lookout for follow-on phishing messages and calls. Never click on links in these messages or hand out information without verifying their authenticity separately
- For health info or customer account details, watch out for more targeted phishing attempts as per the above
- For usernames and passwords, change the credentials immediately for this account and anywhere else it was used. Switch on two-factor authentication (2FA) for an extra layer of security
- For bank or card details, contact your bank or card provider and tell them what happened. Ask for a replacement card and monitor your accounts for suspicious activity
- For government ID (e.g., passports, driver’s license) follow the advice of the issuer. A replacement may be needed
- For financial and identity info, monitor your accounts, contact the relevant financial institution(s), change your logins (if relevant), and consider credit monitoring and a credit freeze
Is a credit freeze or credit monitoring the best option?
Many breached organizations offer free credit monitoring for a year following an incident. Some also offer a credit freeze. But which is better? It’s important to understand the difference.
- Credit monitoring services detect when something changes on your credit file, potentially indicating a fraudster has your details and is trying to get a new line of credit out in your name.
- Credit freeze blocks most access to your credit report, so scammers can’t easily open a new account using your details.
So a credit freeze is more useful, but if either is offered, take advantage of them. The two work best together: place a freeze and accept any free monitoring you’re offered. Just be aware that credit monitoring is only an alert service. It won’t actually prevent follow-on fraud.
As more of us expand the number of organizations we do business with, and as hackers get better at compromising those same companies, the odds of receiving a breach notification will continue to shorten. But it doesn’t have to be the end of the world. Stay alert and stay informed to minimize the risk of follow-on fraud.
Frequently asked questions (FAQs)
How do I know if a breach notification is genuine or a scam?
Never click through on any unsolicited breach notification email or message. Check first with the breached organization, and not by replying to the message or using contact details listed there, but verifying independently.
Why have I received a breach notification from a company I’ve never heard of?
It may be a supplier you’ve never dealt with directly, such as a payroll provider or data processor used by a company you do business with. It may also be a scam, or you may simply not have done business with them for a long time and it could be a historic breach. Either way, read the information carefully and contact the company directly for more information if it looks like sensitive financial or personal information was exposed.
What should I do if my password was exposed in a breach?
Change the credentials immediately for this account and anywhere else it was used. Switch on two-factor authentication (2FA) for an extra layer of security.
What should I do if my financial details and identity information were exposed in a breach?
This is more serious. Monitor any relevant accounts for suspicious activity and contact the relevant financial institution(s). Change your logins (if relevant) and consider credit monitoring and a credit freeze.
Should I use credit monitoring after a breach?
Credit monitoring services detect when something changes on your credit file, potentially indicating a fraudster has your details and is trying to get a new line of credit out in your name. It won’t actually prevent follow-on fraud, but it can be a useful alerting mechanism. If offered for free, accept it. A credit freeze is worth adding: it’s free in the US and blocks most access to your credit report.
