The notice becomes a script
A breach notice tells the public which organisation was affected, what kind of data was involved and how customers will be contacted. Fraudsters reuse exactly those details. Messages that mention the breach, quote the notice and promise compensation or a security check look credible because the breach itself is real.
What the wave looks like
In the anonymised composites we study, the pattern repeats: lookalike domains registered within days of the notice, text messages and emails pointing to fake support or refund pages, and fake services offering to remove leaked data for a fee. The same channels that advertise the leak often carry these lures as well.
Signals defenders can watch
New domain registrations and certificate-transparency entries that contain the brand name, payment pages that copy the organisation's design, and public posts offering to check whether an account was affected. Each of these can be captured, hashed and sent to the registrar, hosting provider or abuse desk without touching the leaked data itself.
What helps customers
Clear, repeated guidance works better than a single notice: which channels the organisation uses, what it will never ask for, and where to report a suspicious message. Publishing the official domains and support numbers makes lookalikes easier to spot, for customers and for the services that block them.
How we approach it
We monitor public sources passively for the affected brand and its suppliers, and we report what we find to the organisation privately. We do not interact with the people running a campaign, we do not buy or download leaked data, and we do not publish details of a breach that has not been publicly confirmed.