What to do if your information is found in a breach

Last March turned out to be one of the worst months for corporate data breaches in Canadian history. First, grocery retailer Loblaw disclosed that a third party had illegally gained access to customer information including names, phone numbers, and email addresses. Then, Telus Digital revealed it had been attacked by a hacker group known as ShinyHunters, which obtained more sensitive information such as customer support records and financial data. Finally, at month’s end, Toronto fintech company Duales acknowledged that it had inadvertently left a storage server containing passport and drivers licence numbers of 360,000 clients of its Duc money transfer app exposed to potential threat actors for approximately five years.

As a consumer, there is little you can do to prevent your information from being stolen in a large-scale breach of a company or government database. If the breach goes undetected, you may not even know it has been compromised; cyber criminals have been known to sell or sit on huge databases for months or even years. 

But if an organization you deal with sends you notice of a breach, which they’re required to do any time a hack is discovered, there are steps you can take to help minimize the damage.

Step 1: Find out what information was exposed

Read the notification from the organization that was breached closely. Follow any specific instructions contained in the notice to protect your information.

Take note of what information was compromised. Disclosure of different data could leave you vulnerable to different threats. Exposed credit card or bank account information could make you vulnerable to a monetary loss in the short term, whereas personal information such as name, email, phone number, and physical address can be used to set up accounts in your name at any time in the future. 

The loss of permanent identifiers such as your birthdate and social insurance number (SIN) can be particularly troublesome and long-lived as they cannot be changed.

Step 2: Change compromised passwords

Immediately change passwords of accounts affected by the breach. If you use the same password on other accounts, which is a common but highly inadvisable cybersecurity practice, you should change those, too. 

Where available, enable biometric multi-factor authentication (MFA) protocols that require more than simply user ID and password.

Step 3: Check your credit reports

Review your credit reports from the two credit agencies, Equifax and TransUnion, to look for signs that someone may have attempted to use your identity. These might include:

Accounts or credit inquiries you don’t recognize Changes to personal information New credit accounts you didn’t apply for

Notify the credit agencies that your information may have been compromised and request that they put a fraud alert on your credit reports. Make a regular habit of checking your credit reports—it’s easy to access your Equifax credit report, plus get access to Equifax credit monitoring options to receive alerts about certain changes or activity. You can also file a dispute if you find inaccuracies.

For a higher level of security, consider subscribing to Equifax Complete Protection, which includes credit monitoring along with dark web monitoring to spot whether your information might be available for sale on the dark web. The service also comes with password manager, social media monitoring, data encryption with a VPN, parental controls, device protection, and identity restoration in case of identity theft—all for $34.95 per month.

Step 4: Watch your financial accounts closely

Closely monitor any accounts affected by the breach. If your payment card account numbers and/or passwords may have been revealed, notify the issuer immediately and ask them to update you when any unusual activity occurs. 

Request new payment cards, but in the meantime, review bank and credit card statements and watch for unfamiliar transactions. If you spot suspicious activity, contact your financial institution right away. Also report the incident to police and the Canadian Anti-Fraud Centre. 

Be alert for phishing attempts and other suspicious emails, text messages, or phone calls after a breach. Criminals may use exposed information to make their outreach appear more convincing or urgent. Keep a record of any suspected nefarious communications you receive.

A breach is a reason to act, not panic

You can’t stop your information from being exposed in a breach, but you can limit the damage afterward. A simple routine of checking credit reports, monitoring accounts, using strong passwords and MFA, and staying alert to scams can help you spot potential problems earlier. For even greater protection, sign up for Equifax Complete Protection.

FAQs

Read more about fraud and scams:

Why digital and virtual credit cards are safer than the real thing How AI is changing online fraud Scammers want your retirement—here’s how to protect yourself Be on guard against fundraising fraud

The post What to do if your information is found in a breach appeared first on MoneySense.