The data type changes the risk
An email address may increase targeted messages. A reused password can expose other accounts. Identity, financial, health or location data can create longer-lasting consequences.
Public systems and disruption
Data breaches: what they mean and what to do
A data breach happens when information is lost, shared, stolen or viewed without permission. First find out what information was involved. Then ask what someone could do with it.
Page T-001Guidance pageReviewed 29 August 2026
Key Guidance
A breach does not always mean someone has stolen your identity, entered your account or taken money. Base your next steps on the information involved and any signs that it has been misused.
Start with Key Guidance for the short answer. Then read the sections that match what happened and what you need to do.
Understand the issue
Why this matters to you
The same breach can affect people in different ways. One person may have only an email address involved. Another may have a password, identity document or private record exposed.
Exposure is not the same as harm
Someone may have seen or copied the information. This creates a risk, but it does not prove that every record was read, sold or used in a scam.
The breach itself can become a story
Criminals can use public concern about a real breach even if they do not have the stolen data. They may send false password-reset, refund or compensation messages.
Consequences can appear later
A breach notice may arrive quickly. Scam messages, account break-ins or identity misuse may appear weeks, months or even years later.
Consequences and movement
What may happen next
Someone may use the exposed information on its own, combine it with details from elsewhere, or simply mention the breach to make contact seem genuine.
Targeted impersonation
A message may mention a real service, booking, address or personal detail. This can make the sender seem informed, but it does not prove who they are.
Account access
Someone may try exposed or reused sign-in details on your email, shopping, social media, cloud or bank accounts. A stolen signed-in session may sometimes still work after you change the password.
Identity misuse
Someone may use your name, address, date of birth or document details to apply for services, change accounts or pass identity checks.
Secondary scams
A false investigator, compensation company or security team may offer to repair the breach, recover money or secure your account for a fee.
Practical response
What you should do
You do not need to take every possible security step. First find out what happened. Then act on the information that was exposed.
- Reach the organisation independentlyUse the organisation's official website or app, or contact details you already trust. Do not use a link or number from an unexpected breach message.
- Identify the information involvedRead the notice carefully. Find out whether your record was affected and exactly which details were involved—for example, your email address, password or identity document.
- Secure affected accountsChange any exposed password. Change it on other accounts if you reused it. Check recent activity, sign out unknown devices, remove unfamiliar recovery details, and turn on two-step verification or a passkey if available.
- Protect identity and financial routesReport a lost or exposed identity document to the organisation that issued it. Check bank statements and credit files when relevant. Challenge any account, application or payment you do not recognise.
- Expect breach-themed contactExpect messages about password resets, compensation, refunds or security. Treat unexpected contact as unconfirmed. Open the genuine service yourself instead of using the link or number provided.
- Escalate actual harmContact your bank or the relevant service at once if money has been taken or you have lost account access. Save the messages and other records. Then report or complain through the right service.
Look more closely
Accurate personal details do not prove a contact is genuine
A correct personal detail can make later contact feel safe and expected. Look at four things separately: what the person knows, who they claim to be, what they want, and whether you chose the way to check them.
News about the breach or a follow-up message gets your attention.
Concern about your account, identity, money or possible compensation makes the message feel relevant.
Real details can support a false claim to be your bank, employer, service provider or an investigator.
The sender may direct you to a link, phone number, download or payment method that they control.
They may want money, sign-in details, identity documents or access to your device or account.
Current developments
Researched feedManchester Airports Group customer-data incident
MAG confirmed that an unauthorised third party obtained data connected with parking, lounge, Fast Track and in-airport Wi-Fi services at Manchester, Stansted and East Midlands airports. It said the affected system did not hold bank or payment details and airport operations were not disrupted.
Read the organisation’s incident statement
What the airport incident means for customers
The facts help you choose the right response. The incident involved customer contact and booking details. It did not affect flight safety or payment-card data in the system that was accessed.
Email addresses, phone numbers, vehicle registrations and postcodes were among the information accessed.
Airport parking, lounge and Fast Track bookings, plus in-airport Wi-Fi sign-ups.
MAG states that neither it nor the accessed system holds customers’ bank or payment details.
MAG states that aviation security, passenger safety, airport operations and customer parking services were unaffected.
What to do with this information
A message may know your airport, postcode or vehicle registration. That can feel convincing, but it does not prove who sent it. Check bookings on the official airport website.
Selected history
Historical cases and lasting lessons
Change Healthcare
A ransomware incident combined extensive health-related data exposure with disruption to healthcare and payment processing in the United States.
Lasting lesson: A breach can affect both information and the service people depend on; individual notices still matter because the data involved differs by person.
MOVEit Transfer
Attackers exploited widely used file-transfer software, creating separate breach consequences across many organisations and countries.
Lasting lesson: One supplier weakness can create many breaches, but each organisation’s notice determines what happened to its own records.
Marriott and Starwood
A long-running compromise of a reservation database affected guests internationally and crossed an acquisition boundary.
Lasting lesson: Travel and identity details can remain useful for impersonation long after the original event, and inherited systems can carry inherited risk.
Transferable understanding
Patterns over time
Specificity increases credibility
Correct details can reduce doubt. They still do not confirm the sender's identity or make a link, number or account safe.
One event creates several public questions
People need different answers: Was I affected? What information was involved? What should I do? Which later messages should I distrust?
Large totals can hide individual differences
A large record count does not show how many different people were affected, how recent the data is, or which details belong to one person.
A breach is often the beginning of a later process
A breach is often the start of a later scam. Someone may use the information to get attention, copy a trusted identity or direct you through a link or number they control.
Plain-language answers
Common questions
Should I change every password after any data breach?
No. Change a password if it was exposed, if the affected account shows suspicious activity or if you reused that password elsewhere. Prioritise email, financial and other high-value accounts.
Does a breach notice prove my identity was stolen?
No. A breach notice means information was exposed or may have been exposed. It does not prove identity theft or fraud. Some types of information still need early protection and monitoring.
Can I trust a message that contains correct personal details?
Correct details may come from a breach, public records, social media or another place. Check both the sender and the request using contact details you found yourself.
What if the organisation will not explain what happened?
Keep a record of your contact. Make a written data-protection complaint to the organisation. If its response is still poor, consider complaining to the ICO.
Reporting, support and recovery
Choose the organisation that matches the problem. Ask the affected organisation what information was involved. Contact your bank or payment service about financial loss, the relevant service about lost account access, and the ICO about unresolved data-protection concerns.
Scamology Insights
Learn to separate known information from claimed identity
Learning resources can help you see how exposed information may be used in later contact and where you can still stop the process. Links to the apps, tools, books and courses are not included in this first version.
Continue understanding
Explore related guidance
Evidence and currency