Your Data Was Leaked – Here’s What to Do Next to Protect Yourself

November 26, 2024

Unfortunately, data leaks have become a part of life, with almost all people’s data being released in a leak in some form. As more and more of our data and information is held on digital platforms, the risk of it being exposed increases. Vulnerabilities mean that both large and small companies that hold our data can be subject to a hack and data being leaked.

Although there are limited actions that can be taken to secure our data, with that responsibility falling to the companies that store our data, it is important to know what actions can be taken when data is leaked to protect people and organizations and minimize the damage.

It is important to note that once data appears on the dark web it cannot be removed, and there is no way of knowing who has access or has accessed that information. However there are actions that can be taken to mitigate risks when your data appears in one of these leaks.

Monitoring

An important first step is actually knowing that your data has been leaked whether personal information or your corporate information. It is important that you are monitoring all PII (personally identifiable information) to identify if it appears in a leak, and if it does what leak it appears in and what information has been exposed.

It is also important to confirm if the details of the leak are correct, what was the source of the leak and what types of data are exposed? Leaks are often reported in the media, by the company themselves usually for regulatory purposes or through leak monitoring services. You should identify what sensitive information has been exposed whether it be an email address or social security number. This can help you focus on securing your most at risk data.

DarkOwl Vision allows you to monitor all of your company’s assets to identify if they have appeared in a data leak. Our Leak Context feature will provide details of the leak, where it was sources and if it has been confirmed.

Figure 1: Example of Leak Context feature

Change your Passwords

If your passwords are exposed, and maybe if they aren’t, a good step to ensure your accounts are secure is to update your passwords. A company should have a good password policy that means that passwords are updated regularly. Even if it has been identified that a password hasn’t been exposed, it should still be changed immediately.

When reviewing your password policy, whether in response to a leak or as a good security practice the following things should be considered:

Use a Strong Password – A strong and unique password should be used for each of your accounts
Do not reuse passwords – A unique password should always be used
Enable Two-Factor Authentication (2FA) – Where possible ensure you make use of 2FA. Authenticator apps are more secure that One Time Passwords (OTPs)
Make use of Password Managers – PMs can ensure that you generate complex and use unique passwords.

Figure 2: Time to Crack Passwords of Varying Degrees of Character Length and Complexity

Freeze your Credit Report

Especially if a leak includes financial information, you should freeze your credit report. This is also true if sensitive information such as your social security number is exposed. It is best practice to keep your credit report frozen unless you need to use it yourself.

You should also review and monitor your bank and credit card statements to ensure no suspicious transactions take place. Any identified issues should be reported immediately.

Phishing Scams

The information which appears in leaks can be used to make phishing scams more believable. It can also be used to target individuals who may be associated with a target organization. As AI matures, it is more likely that phishing messages will become more convincing and more difficult to spot. However people should be on the lookout for the following:

Any messages which ask for personal information
Include attachments or links
Urge you to take immediate action
Ask you to make any kind of payment

If you think an email or SMS is suspicious always attempt to verify the legitimacy by contacting the alleged sender. You should do this directly not in response to the message.

Figure 3: Example of an unclaimed asset scam email claiming that the recipient was entitled to property from either inheritances, or from unallocated government holdings

Other Attack Types

While phishing attacks are the most likely threat to occur when data is leaked there are other threats that individuals should be aware of.

Variations of phishing attacks are smishing and vishing. If a phone number is leaked you may become a more likely target for these types of attacks.

As mentioned above in relation to credit freezes, if financial information is leaked you are much more likely to be a victim of financial fraud. This can happen at both the personal and organizational level so it is important to be vigilant for any changes in your finances as well as the possibility of identity theft.

If an organizations network information is exposed, such as private domains, IP addresses or admin credentials are exposed this can leave organizations more vulnerable to hacking attempts. Any data leaked relating to the organizations security or infrastructure should be immediately reported to the cyber security and incident response teams so they can take effective mitigation actions.

Security Implemented Across all Accounts

If your data is exposed, it is best practice to ensure that all of your accounts are secure, not just the one associated with the data leak. As passwords are often reused and email addresses used across multiple accounts your information could be used to target multiple accounts.

You should also check your privacy settings across all accounts, sometimes information used in phishing attacks and other social engineering attacks can be obtained through data brokers or from social media accounts. You should therefore ensure on all accounts that unnecessary access is revoked and make sure that your accounts are either private or if you need to share information make sure you know what information is being shared and limit this where possible.

Transparency

For organization that identify their information or their employees information has appeared in a leak, it is important to make sure you inform people of what data has been exposed and what implications this may have for them. It’s important to reassure clients, partners, and employees that you’re addressing the breach and safeguarding their information. Include these elements in your communication plan:

Notify Key Stakeholders – Share essential information with those affected, including an explanation of the breach, the data involved, and recommended steps for safeguarding their own data.
Provide Reassurances – Explain any steps the organization is taking to mitigate the impact, such as enhanced security measures or support resources.
Outline Remediation Steps – If offering credit monitoring, cybersecurity resources, or identity theft protection, make it clear how stakeholders can access these services

Incident Response for Third-Party Breaches

In some cases, it may be prudent to have a plan in place for if your organization’s data appears in third party data leak. This will not be required in every case and will depend on which leak data appears in and what data is exposed.

Responses to leaks can be part of an overall Incident Response Plan, mitigating actions that can be part of these plans when it comes to leaks are:

Assemble a Response Team – Bring together key internal stakeholders, including IT, legal, risk management, and PR teams.
Engage with the Third Party – Ensure open communication with the vendor to receive continuous updates and understand what actions they’re taking to address the breach.
Coordinate with Legal and Compliance Teams – Confirm the legal obligations that apply to data exposures resulting from third-party breaches, such as notifying regulatory bodies and customers.

Data Privacy Considerations

Legal and regulatory compliance is essential when dealing with third-party breaches. Ensure your response is aligned with data protection regulations that apply to your business and industry, such as GDPR, CCPA, or HIPAA. In many cases, your organization is responsible for notifying affected parties, even if the breach occurred due to a third-party vendor.

Consult Legal and Compliance Experts – Engage your legal team to understand notification requirements and determine if the breach must be reported to regulatory bodies.
Document Your Response – Maintain thorough documentation of all actions taken in response to the breach, including communications with the third party, incident assessments, and mitigation measures. This can protect your organization if regulators review your actions later.

Cyber Security Training

It is also important that organizations provide regular cyber security training to their employees to ensure that they understand how they should be protecting both their personal and corporate data. This training can also advise individuals on what action should be taken should their information be leaked and what risks they should be on the lookout for and how to mitigate them. All employees should understand how to handle corporate data securely and what to do if they notice suspicious activity.

Conclusion

While data leaks are alarming, having a plan can make a big difference in minimizing their impact. By acting quickly and taking the necessary steps to protect your or your organization’s information, you can significantly reduce the potential risks to finances and privacy.

Data breaches involving third-party vendors pose unique challenges, but with a proactive approach, organizations can mitigate the impact. By responding swiftly, communicating transparently, and strengthening security practices, organizations can protect thier data, reputation, and relationships with stakeholders

Stay vigilant, be proactive about security, and take charge of your or your organization’s digital footprint—it’s the best defense against future breaches.