A data breach email can be genuine or fraudulent, even when it contains your real name and address. To check, open the organisation's usual website or app yourself. Find its security notice or contact support through a channel you already know, without using contact details from the suspicious message.
The subject alone is unsettling: “Your personal information has been compromised.” The email names a service you use, describes an incident and offers a button to protect you. Start with one question: who is asking me to do what?
A real breach can be used in a fake message
A public announcement and an email in your inbox are separate things to verify. The incident may be real while the sender offering help has no connection with the affected company.
The UK NCSC explains that criminals exploit breach announcements, even to contact people whose information was not stolen. Receiving a message after a news story does not establish that you were affected.
In France, the CNIL issued a warning on 24 June 2026 about emails offering removal assistance to breach victims. Some use genuine stolen details and mention the regulator without any affiliation. Knowing your details does not authorise a sender to act on your behalf.
Verify the warning in four steps
1. Record what the message claims without replying
Note the organisation, incident date and types of data mentioned. Separate these claims from the requested action: reading a notice, entering a password, providing identity documents or paying for a service.
Technical language does not make a vague message reliable. Equally, good spelling is no guarantee of authenticity.
2. Reach the organisation independently
Use its normal app or a bookmark you trust. Look for a notice in your account or on its official website. If you use a search engine, check the domain before entering information.
If you cannot find an announcement, contact support through that website. The absence of a public statement does not establish that the email is fake. Information may have been sent directly to affected people.
3. Confirm the specific request
Ask the contact you found independently:
- Have you sent users a data breach notice?
- Is my account affected, and which details are involved?
- Do I need to do something inside my account?
- Is the provider named in this message actually working for you?
Do not paste your entire personal file into the first exchange. The aim is to verify the request without adding to your exposure.
4. Act on what you have confirmed
If the organisation confirms both the warning and the action, complete it through its official service. If the message remains suspicious, use your email provider's reporting feature and keep relevant evidence. For a commercial provider, separately examine its identity, offer and any permission you have given it.
The FTC also recommends contacting a company through a known website or number, rather than details supplied in a suspicious message.
Details that can create false confidence
A name, an old address, a familiar logo and a polished layout are not enough. They do not establish who controls the sending account or destination website.
Fictional example: an email quotes your former address and demands €4.90 before midnight to “remove your record from every database”. The address may be correct. That establishes neither possession of the claimed file nor the ability to erase every copy.
A fee alone does not prove that an offer is a scam. Check the provider, promised work, scope and terms you are accepting. Our analysis of BrixHub and paid removal of leaked data explains why deleting a searchable record is different from destroying a leaked file.
Can Have I Been Pwned confirm the email?
HIBP can report known exposure, but it cannot authenticate the message you received. Open the official site yourself and compare the listed incident with information from the affected organisation.
A positive result does not establish that the sender is authorised to contact you. No result does not prove the warning is false either: the HIBP FAQ explains that its database does not contain every breach.
Our guide to using Have I Been Pwned explains the data categories and limits of its results.
Already clicked or shared information?
Opening a page alone does not establish that you were hacked. Close it and identify what you actually did: entered information, downloaded a file, installed software or made a payment.
- Entered a password: change it through the real service and anywhere else you reused it.
- Shared payment details: contact your bank immediately through its usual channel.
- Downloaded a file or installed software: seek help appropriate to your device; do not continue following the message's instructions.
Keep the message and relevant evidence. France's Cybermalveillance.gouv.fr phishing guidance, in French, explains these responses and French reporting options. In the UK, use the reporting guidance in the NCSC resource above; in the US, consult the FTC resource. Elsewhere, use your national cybercrime reporting service. Our exposed password action plan helps prioritise account protection.
After verification, review your wider exposure
Once urgent steps are taken, you can examine the information circulating about you. The free Data Knight digital footprint scan brings together detected public traces, brokers that may hold your details and known breaches covered by our sources. A suggested broker is not proof that it holds your information.
This scan does not certify an email's authenticity. It answers a different question: which traces can we identify, and what actions could follow? View a sample report before starting.
Review the findings, select those that concern you and, after giving authorisation, delegate removal requests according to your chosen plan. Always-on Protection supports follow-up over time. Payment covers the specified service and work, not a promise to destroy every copy of a breach.
Our blog remains available if you prefer to act yourself. Verify the warning, understand your exposure, then choose what to delegate. You stay in control of that decision.
Read next: data breach with no passwords leaked · spam calls and texts after a breach · understanding paid removal at BrixHub.
