Privacy UnpackedScam radar
Scams that use data breaches
Published warnings that criminals are using a breach on the tracker · updated twice a day
After a breach, criminals use it: messages that pretend to be the company, its support team, a refund or a settlement, written with the details that leaked. The radar collects the warnings: from the breached companies themselves, from authorities such as the FTC and the UK’s NCSC, and from established news and security outlets. Every warning is quoted from its source and linked to it. We never link to the scams themselves.
- Warnings, 30 days
- 1
- Breaches with a warning
- 1
- Scams seen, not just expected
- 0
The latest warnings
-
Phishing emails targeting exposed Capcom ID email addresses from breach of 11.7 million records
Warned by Capcom:
Exposed email addresses could put CAPCOM ID users at risk of phishing.
Malwarebytes
The scams that follow a breach
- Fake “support” or security teamA call, text or email says your account is at risk after the breach and asks you to log in, read out a code or move your money “to safety”. Real companies never ask for a code, a password or a recovery phrase.
- Fake refund, compensation or settlementA message offers money for the breach and asks for card details, a fee or your login. Compensation comes in the company’s own app or account, and real settlements are filed on the court-named site, for free.
- Phishing that uses the leaked detailsThe message knows your name, address or order history from the breach, to look real. Knowing your details does not make a message genuine.
- Threats and extortionSomeone says they have your data and asks for payment to delete it or keep quiet. Do not pay or reply; keep the message and report it to the police.
- “Recovery” offersAfter a breach or a hack, someone offers to get your money back for a fee. Nobody legitimate does that; it is a second scam.
Got a message about a breach? Check whether it is real. Were you in one? See your breaches and what to do.
How the radar works
Twice a day the radar searches the news for each of the tracker’s larger recent breaches together with scam words, and reads the FTC’s consumer alerts and the UK National Cyber Security Centre’s news for any that name a company on the tracker. Each page is read once by an AI model that answers one question: does it warn that criminals are using this breach, and how. A warning is kept only when the sentence it quotes is on the page word for word, and only when it comes from the breached company, an authority, an established news outlet or a security company’s own research. “Seen” means the source says the scam has actually been sent; “Warning” means it says one may come. Found a mistake? Tell us.
From the data breach tracker: official notices, breach databases and the news, every fact with its source. Open data (CC BY 4.0) · How the tracker works · Official registers · Corrections and changes · Found a mistake? Tell us and we correct it.