Service Provider Breach
When a company who you use gets hacked your data may have been exposed to the cyber criminals - or the world if the information was published online by mistake.
Your data may be used by cyber criminals to access that account or to target you in future cyber crimes. For example if they get your email address and password then they are likely to either try to log in to your other accounts or send you a phishing email trying to trick you into enabling a cybercrime.
Use this guide if you have been notified that a service, app, company or website you use has been hacked.
We want to better understand the impact of you experiencing this issue, can you share your experience by filling in this online form? This will help us better protect future victims.
Approaches to dealing with a Service Provider Breach
Every breach is different and the impact on you may range from harmless to devastating. Here are some key things to do in any situation.
Check if it is real - if you received a direct message from the company - an email, call or text - first of all you need to make sure you are not being tricked by a cyber criminal. The best thing you can do is go directly to the company’s website and look for evidence that they are talking about a breach. Most will have a banner on their homepage or an item in the news section. You can also contact the company directly and ask about the breach. Do not use any links provided in an email, text or phone call to contact the company - they may be fake.
Find the provider’s guidance - the hacked company will provide some specific guidance for what you should do next. This will cover what has happened, what you should do next and what support the company can offer you. This will always be on the company’s website - or at least linked from the company’s website.
Change the exposed username & password - Whether these details have been hacked or not, it is always a good idea to change your login details. If available you also want to enable two-factor authentication to add an extra layer of security. Remember if you use these login details elsewhere you need to change those too.
Understand what data has been accessed - Once you know what data has been exposed you need to think through the wider impact. If you use the same username and password combination on other sites then you need to go and change then ASAP. You also need to be conscious that you may receive malicious emails to that email address. If something more private has been exposed, like your messages, sexuality or extracurricular activities, then you will need to think through what to do next.
Contact the provider - it may be worth contacting the provider directly and asking for more detail around your specific account. They may be able to share more with you one to one than they could in the press or over email. Be aware their customer support team is likely to be very busy!
Keep up to date with the news - it often takes time for a company to realise the extent of a breach. Even when they know the data has been accessed, it can take days and even weeks to investigate how the hacker got in and what they did. Companies may release more detail as they find out more from their internal investigation, so keep up to date with the news surrounding the breach.
Monitor your security - Now your data is in the hands of criminals you have to be switched on to your online security posture. Be careful of calls, text messages and emails. Check the security settings of your devices and online accounts and investigate anything suspicious. Use sites like Get Safe Online or Cyber Aware to improve and understand your security.
Take advantage of free security offerings - many organisations who are hacked offer their customers free security tools to help them deal with the impact of their data being known to cyber criminals. This might be free credit score checks, free security software or access to expert advice. This will be listed on the providers website alongside the breach notification.
How do I minimise the damage of a Service Provider Breach in future?
Have unique passwords for each account - this takes extra effort, although a password manager makes it easier, but has a big impact if one set of log in details is hacked. At least make sure that your email and online bank account has a secure separate password.
Check if you have been pwned - the haveibeenpwned.com website, run by cyber security experts, is a great tool for understanding if your information has been hacked in known public breaches. You enter your email address and it tells you what breaches the email address is linked to and what information was gained by hackers. Make sure that none of your current login details match those in past breaches.
Be good at security - Use sites like Get Safe Online or Cyber Aware to improve and understand your security. The more secure you are, the more likely the cyber criminal is to move on to an easier target.
Take advantage of service providers free security settings - every device you have and online account you use will have a security or privacy section. Unfortunately, not all the security settings are on by default, but it is easy to review and switch them on. Two-factor authentication and account recovery information are key.
Select secure providers - when you are choosing an app or an online account think about security. Check what security they have, if they have a history of being hacked or that they have a security certification like Cyber Essentials.
Donate
To help people like you we rely 100% on donations from people like you.
Without donations we cannot keep our service free and provide help to the most vulnerable victims of cyber crime when they need it most. As a not-for-profit organisation, 100% of your donation goes towards keeping The Cyber Helpline up and running - so 100% goes towards helping people like you. Donate now and help us support victims of cyber crime.