Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minutePhishing emails can feel more convincing after a data breach because exposed details may help a scammer tailor a message to you. A note that names your employer, account, or a plausible breach-related problem can sound credible—but those details do not prove the sender is legitimate. Verify unexpected messages through a company’s known website or phone number, not through the message itself.
Why am I getting emails that know so much about me?
Phishing is an attempt to impersonate someone you trust so you will reveal information, click a link, or open an attachment. CISA defines spearphishing as phishing targeted at an individual by including key information about them. A breach can expose details that might help make a lure more specific, though that does not mean every breach leads to targeted phishing. CISA’s 2024 phishing guidance provides that definition.
Scammers may frame a message around a suspicious login, payment problem, invoice, or request to confirm personal or financial information. Personal context can make such a story seem to fit your circumstances. The Federal Trade Commission (FTC) describes these common pretexts in its guidance on recognizing and avoiding phishing scams.
A familiar company name or correct-looking personal detail can be copied or misused. There is no established figure in the cited guidance for how much a breach increases the chance that a particular person will receive or fall for phishing. Treat a message’s specificity as a reason to check it—not as proof that it is genuine.
#1 Best Overall
How can I tell if an email about the breach is real?
Do not use the message as evidence of its own legitimacy. The FTC advises avoiding unexpected links and attachments and contacting the purported company or bank using contact information you already know is genuine. If the request might be real, verify it outside the message thread.
- Do not click an unexpected link, open an attachment, or provide credentials or financial details in response.
- Visit the organization’s known website by entering its address yourself, or call a number from a trusted source. Do not rely on a link or phone number in the suspicious message.
- Compare the message with the breach notice: does it describe the information exposed and match the organization’s stated methods for future contact?
- If anything does not match—or you are unsure—contact the organization through a known channel.
The FTC recommends that organizations explain what information was exposed and how they will contact consumers in the future. It says this can help victims avoid phishing tied to a breach. See the FTC’s Data Breach Response: A Guide for Business (August 2023). Its consumer advice likewise says to contact a company or bank using a phone number, email, or website you know is real if a message might be legitimate: FTC, “Protect yourself from phishing scams” (April 2025).
What should I do if I shared information?
Choose next steps based on what was exposed or what you may have given away. The FTC directs consumers to IdentityTheft.gov’s breach guidance for steps tailored to the information involved.
- Social Security number: FTC guidance recommends obtaining free credit reports and checking for accounts you do not recognize.
- Card, bank, or account details: Use the relevant institution’s known website or phone number to ask what protective steps apply.
For a Social Security number exposure, see the FTC’s What To Do After a Data Breach guidance.
How can I reduce the risk of account takeover?
Turn on multi-factor authentication (MFA) for accounts that offer it. MFA adds another check beyond a password, making account access harder even if a scammer has your username and password. A one-time code or security key can serve as a possession factor. A security key only makes sense if the account and your devices support it and you can use and safely retain it. MFA can reduce some account-takeover risk; it does not make a phishing email safe. The FTC explains MFA and security keys in its phishing guidance.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Where can I report phishing?
The FTC recommends reporting phishing emails to the Anti-Phishing Working Group and to the FTC. Its reporting advice appears in How To Recognize and Avoid Phishing Scams.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
