Accounts & passwords
A company told me my data was in a breach. What should I do?
Getting an email saying your personal information was in a data breach is unsettling, and it’s become common. What you should do depends on exactly what was taken. Often it’s a few practical steps and some extra caution for the next few months.
The short version
Work through these
- Check the notice is genuine by going to the company’s website yourself.
- Find out exactly what information was exposed.
- Change any exposed or reused passwords.
- Expect more convincing scams for a while.
First, check the notice is real
Scammers send fake breach notices to trick people into “verifying” their details. Don’t click links in the notice. Instead:
- Go to the company’s official website and look for a statement about the breach.
- Check for news coverage of a breach at that company.
- Call the company using a number from its website or a bill.
A genuine notice should explain what happened, what information was involved, and what the company is doing about it. Under the Notifiable Data Breaches scheme, many organisations must notify you if a breach is likely to cause you serious harm.
What to do, based on what was exposed
| Information exposed | What to do |
|---|---|
| Email address only | Expect more phishing. Be extra careful with emails that seem to come from that company. |
| Password (even if “encrypted”) | Change it on that site and anywhere else you’ve used it. Turn on two-step verification. |
| Phone number | Expect more scam calls and texts. Consider asking your carrier about protections against SIM swap fraud. |
| Date of birth and address | Not enough on its own for most fraud, but combined with other details it helps scammers. Stay alert. |
| Driver licence | Contact your state or territory licensing authority. Many will replace the licence and card number after a breach. |
| Passport | Contact the Australian Passport Office about whether to replace it. |
| Medicare card | Contact Services Australia to ask about a replacement card. |
| Bank or card details | Contact your bank. They may replace the card and watch the account. |
| Tax file number | Contact the ATO, which can add protections to your record. |
If identity documents were exposed, IDCARE on 1800 595 160 can give you a free, personalised plan.
Protect your credit file
If you’re worried someone could apply for loans or credit in your name, you can ask Australia’s credit reporting bodies, Equifax, Experian and illion, for a free credit ban. While it’s in place, lenders can’t access your credit report, which stops most credit applications. You can also get a free copy of your credit report to check for anything you don’t recognise.
Watch for follow-up scams
After a big breach, scammers often contact people pretending to be:
- The breached company, offering compensation or “identity protection”
- A government agency, saying your identity has been used in a crime
- A lawyer, offering to join you to a class action for a fee
- A bank fraud team, warning that your account is at risk
Treat any unexpected contact about the breach with suspicion. Go to official websites yourself rather than using links or numbers you’re given.
Already in many breaches?
Check your email address on Have I Been Pwned, a free service that shows which known breaches it appears in. It’s a good prompt to change any old passwords still in use.
Your rights
The Office of the Australian Information Commissioner (OAIC) oversees privacy law in Australia. If you’re unhappy with how an organisation handled your information or a breach, complain to the organisation first. If that doesn’t resolve it, you can complain to the OAIC.
Common questions
The company says the passwords were encrypted. Do I still need to change mine?
Yes. Some encryption methods can be cracked, especially for common passwords. Changing it, and any reused versions, is quick and removes the doubt.
Should I pay for identity monitoring?
It isn’t necessary for most people. The free steps above, including a credit ban if you’re worried, cover the main risks. Some breached companies offer monitoring for free.
How long should I stay alert?
Stolen data can be used for years. Be extra cautious for the first few months, and keep good habits after that.
Sources
This guide is general information, not legal or financial advice. If you think you’ve lost money or personal information, contact your bank and the services named above straight away.
Keep reading
Related help
Talk to NovaSoft
Want a hand with this at work?
These guides are free to use. If your business wants help putting the checks, accounts and devices in place, our team can do it with you.