What to do if you suspect your data has been leaked in a breach affecting a service you use

Users usually have little control over whether a service they use becomes the target of a data breach. However, there are steps everyone can take to protect their information. People can also influence what information they provide to different services and how well prepared they are for the consequences of a potential data leak.

“A data breach rarely ends with the breach itself. Leaked information may later be used for targeted phishing attempts, account takeovers and identity theft, meaning that victims or their loved ones can remain targets of criminals long after the original breach,” Havastila says. 

Consider what information you share with services

Many services need personal data about their users. Banks, healthcare services, insurance companies and telecommunications operators, for example, cannot operate without processing personal data. However, the need for information is not equally evident in every service.

“It is worth considering whether a service genuinely needs all the information it requests. You should not provide your date of birth everywhere, for example, but use common sense to assess what the service actually needs. Give services only the information that is necessary, and be especially careful when sharing sensitive information such as your personal identity code or banking details. The less unnecessary personal information you provide, the more limited the potential consequences of a data leak will generally be,” Havastila advises.

The permissions requested by applications should also be proportionate to their intended purpose.

“If, for example, a flashlight application asks for permission to access the photos, contacts or messages on your phone, you should stop and consider why it needs that information,” Havastila says.

How to assess the reliability of a service

It is impossible to assess the security of a service fully from the outside, and no service is completely immune to data breaches. Before providing information, however, it is worth checking a few basic points.

Havastila first recommends checking that the service’s website provides sufficient information about the company, such as its business ID and up-to-date contact details, as well as information on how personal data is processed.

“Reliable services explain openly how personal data is collected, used and stored. Users should review the service’s privacy information to understand what data is collected and how it is used,” Havastila says.

“Information may end up being used in unwanted ways for reasons other than a data breach. It is therefore also worth assessing what kind of company you are providing your information to and what the service says about its use of the data,” Havastila adds.

For websites, make sure the connection is encrypted and the web address begins with https://. Applications should also be downloaded only from official app stores. 

Protect your accounts in case a service suffers a data breach

As no one can know for certain which service will be targeted next, it is important to protect your user accounts.

“One of the most common risks is reusing passwords. If the same password is used for several services, the consequences of a single data leak can quickly spread to the user’s other accounts,” Havastila says.

A unique, strong password should be used for every service. Multi-factor authentication should also be enabled whenever it is available.

“Multi-factor authentication is one of the most effective ways to reduce the risk of account takeover. Even if a criminal obtains the password, it will generally not be enough on its own to sign in to the service,” Havastila says.

Data breach monitoring can help identify whether your personal information appears in known data leaks, allowing you to respond at an earlier stage.

If you suspect your information has been leaked, take these precautions

If you later suspect that your information has been leaked, Havastila recommends acting quickly.

“Changing the password for the service is the first recommended step and should be done without hesitation. If the same password has been used for other services, it should be changed in all of them. Services often allow users to sign out on all devices, and this is advisable when changing the password. Multi-factor authentication should also be enabled if it is not already in use,” Havastila advises.

If you suspect that your online banking credentials or payment card details have fallen into the wrong hands, contact your bank immediately.

Following a data leak, be especially cautious about emails and text messages asking you to sign in to a service or confirm information through a link.

“After a data leak, the scam attempts arriving by email or phone may be more convincing than usual. Instead of following links in messages, access services by typing the address directly into your browser or by using the official application,” Havastila says.

How criminals may use leaked information

What can stolen information be used for? Havastila points out that any information can be valuable to criminals. Even information that appears harmless can become damaging in the wrong hands when combined with other data. Data breaches are often motivated by financial gain, but they may also involve extortion, intelligence gathering or deliberate disruption.

“Data breaches are no longer exceptional events but part of everyday digital life. The better accounts are protected and the faster people respond to a potential data leak, the more likely it is that the damage will remain limited,” Havastila concludes.

Leaked information may be used for purposes including:

• targeted scams and phishing messages

• taking over user accounts

• identity theft

• payment and credit card fraud

• applying for loans or entering into other commitments in the victim’s name

• extortion using personal information

• planning further scams and crimes.

Media enquiries:

Heidi Havastila, Director, Value-Added Services, DNA Plc, tel. +358 44 044 3224, heidi.havastila@dna.fi

DNA Corporate Communications, tel. +358 44 044 8000, communications@dna.fi

More info:

• The Suomi.fi service has published an official guide for people in Finland on what to do in the event of a data leak. The guide is available at www.suomi.fi/oppaat/tietovuoto.
• Victim Support Finland also offers advice for those who have fallen victim to a data breach or data leak: https://www.riku.fi/toimi-nain-jos-tietojasi-on-vuodettu-verkkoon/.