A breach can still put you at risk even when no passwords were stolen. A name, phone number or address does not automatically give someone access to your accounts. It can, however, make a scam more convincing, enable unwanted contact or add to information already available elsewhere.
A breach notice says your passwords are safe. That is good news for those credentials. To decide what to do next, check which other details were exposed. Different types of information call for different responses.
What “no passwords compromised” actually means
This statement describes part of the incident's scope, based on what is known when the notice is issued. It does not mean your account was hacked. It also does not establish that every other part of your personal information is safe.
A documented example comes from France. In its 13 March 2024 notice about France Travail, the French regulator CNIL reported exposed identity and contact details. Passwords and banking details were not affected according to the information available at that time. The regulator also warned about combining the records with earlier breaches. Read the CNIL notice in French.
The useful question is: what could the exposed information make easier? An email address, a medical record and a copy of an identity document do not warrant the same response.
The risks depend on what was exposed
These examples help you interpret a breach notice. They are possible scenarios, not evidence that fraud has happened to you.
Your name and email address
A message might include your first name and mention a service you use. That does not establish who sent it. Someone who already knows your identity may be trying to obtain something else: a payment, a password or a sign-in code.
Your next step: open the service's usual app or website yourself to check an unexpected request. Personalisation is not proof of authenticity. The UK NCSC explains how criminals exploit breach announcements, including to approach people whose details were not exposed.
To check a notice you received, follow our four-step guide: data breach email, real warning or phishing scam?.
Your phone number
An attempt could arrive as a text or a convincing phone call. Imagine a caller mentioning your name and a past purchase before asking for a code sent to your phone. Knowing those details does not make them entitled to that code.
Your next step: end the exchange and contact the organisation through a channel you already trust. Our guide to unwanted calls and texts after a breach explains how to distinguish different forms of unwanted contact.
Your home address and date of birth
These details can add to a personal profile. An old address still says something about you. A current address can also create a privacy concern even if no one attempts to sign into an account.
Your next step: separate the information listed in the breach notice from details currently visible on public pages. For the latter, keep the exact URL and note what is displayed. Our guide covers ways to reduce exposure of your home address online.
Identity documents, financial information or health records
The fact that passwords are unaffected becomes less useful here. Follow guidance specific to the records involved and seek appropriate help if you notice misuse. Avoid sending further documents to an unverified caller who claims they can “secure” the ones already exposed.
France's national assistance service, Cybermalveillance.gouv.fr, provides a breach response guide. Its reporting procedures are specific to France; use the relevant authorities in your own country.
Will changing your password fix the problem?
A new password does not change your phone number or recall files that have already been copied. Follow the affected service's security instructions. If a password was compromised or reused on other accounts, replacing it is a priority. Check unfamiliar sign-ins and the recovery settings on important accounts too.
Even when passwords are excluded from the breach notice, using distinct passwords and enabling two-factor authentication remain useful protections. They help secure account access without removing exposed contact details.
If you discover that credentials were affected after all, use our guide to the first steps after a password leak.
A practical way to decide what to address
We suggest keeping three separate sections in a private note:
- What is confirmed. The organisation, the date of its notice and the categories of information it says were exposed. An anonymous message is not confirmation.
- What is visible. Public pages that actually display your details, with their URLs. A matching name may belong to someone else.
- What has happened. A suspicious call, an unfamiliar login or an unexpected request. Keep useful evidence without posting your personal details on a forum to ask for help.
This distinction prevents possible exposure from being mistaken for proven fraud. It also makes each next step clearer: securing an account, reporting a message and requesting removal of a page solve different problems.
Check your exposure with Data Knight
The free digital scan helps you review public traces, data brokers and known breaches covered by our sources. Your report helps you identify relevant findings and decide what to do next. A report with no findings does not certify that your information has never leaked.
Start with a free report, choose the traces you want to address, then select a paid service if you want us to handle removal requests and follow-up. You can see a sample report first. Our guides remain free to read if you want to understand the process yourself.
Past social posts may reveal a city, employer or personal habits. Our social audit and Knights guide explains how to review content from supported networks. One Knight pays for AI analysis of one eligible item. This complements a digital scan; it does not establish that a breach occurred.
For ongoing action, Continuous Protection combines request follow-up with checks for reappearing data within the service's coverage. It includes 1,000 Knights each month to analyse your social media.
Our aim is to reduce exposure where action is possible. A request to a website can lead to a page or record being removed. It cannot recall every copy of a stolen file. That distinction also matters when assessing paid removal websites such as BrixHub.
Read next: understand Have I Been Pwned, respond to a password leak and review past social content.
