What people can do
What people can do
If your details were in one of these incidents, or you hold files like these, start here. The first list is for people. The second is for the organisations and administrations that keep the data.
Knowing your address, IBAN, tax office, school, order or date of birth does not make a caller or message genuine. Those details are exactly what leaks.
For the general public
These steps do not replace an official notice from the organisation that held your data. They are the habits that still help after a leak, including months later.
Assume leaked details may be used in scams
A caller knowing your address, IBAN, tax office or recent order is not proof they are legitimate. Hang up and start from a number or site you already trust.
Read this guideOpen official services yourself
Do not use a link from an unexpected email or SMS about taxes, deliveries, identity documents or banking. Open the official app or type the site address yourself. Bookmark that address so you are not guessing under pressure.
Read this guideA named school, class or tax office is still not official
Those details are exactly what leaks. Open ÉduConnect, impôts or ANTS yourself. Do not use a link from an unexpected SMS.
Read this guideNever share a one-time code on an inbound call
A caller who recites your address or IBAN still needs you to read a banking or tax code, or to approve a payment. Hang up. Open the official app yourself.
Read this guideDo not install remote-control software because someone asked
A “technician”, bank or tax agent who needs you to install a tool so they can “secure your account” is running the fraud. End the call and use the official app.
Read this guideUse unique passwords and passkeys
A password manager prevents one stolen password from unlocking several services. If this service held a password you reused, change it on every other account that shared it. Enable MFA wherever available.
Read this guideWatch financial activity
An exposed IBAN does not normally let someone directly take over an account, but it can support convincing fraud. Review transactions and bank alerts. Turn on alerts for new mandates and unusual transfers.
Read this guideTake unexpected SEPA mandates to your bank
An exposed IBAN can support a convincing direct-debit story. Do not confirm a mandate with the caller. Dispute it through your bank.
Read this guidePreserve evidence
Keep suspicious emails, SMS, URLs and screenshots if you believe stolen data is being used against you. Report through official channels you open yourself, starting at Cybermalveillance.gouv.fr.
Read this guideExpect delayed attacks
Stolen data can circulate for months or years. Increased caution should not end a week after the breach notice. Treat a message that reuses the organisation’s name months later the same way you would treat one that arrives tomorrow.
Read this guide
For organisations and government
The same weaknesses keep showing up in the public record: phishing, over-broad access, suppliers, and extraction that nobody noticed in time.
Use phishing-resistant MFA
Prefer passkeys or hardware-backed authentication for administrators, remote access and sensitive databases. Avoid relying on SMS for privileged access.
Make least privilege real
Separate everyday accounts from privileged accounts, review access continuously, and require stronger controls for bulk queries or exports.
Segment sensitive systems
Compromise of email or a training system should not become a route to police, tax, identity or financial datasets.
Detect extraction, not just login
Alert on unusual record volumes, new locations, odd query patterns, bulk downloads and service-account behaviour.
Treat suppliers as part of your perimeter
Contract for minimum controls, incident notification, logging, access boundaries and data deletion. Verify, do not just collect questionnaires.
Reduce retained data
If a supplier does not need historical data, delete it. Less retained data means less to steal.
What criminals do with leaked data
Want the longer version of why a leak is dangerous? Read the public explainers
Why leaked data is useful to criminals
A data breach is not only a password problem. The details that leak are what make the next message or phone call look official.
Read this guide
Phishing that already knows you
After a leak, the dangerous message is the one that sounds informed. Names, addresses, contract numbers and loyalty IDs are the raw material.
Read this guide
What an IBAN leak lets someone do
An IBAN in a stolen file is not a PIN. It is still dangerous, because it lets a stranger talk about your bank account as if they already belong in the conversation.
Read this guide
When the leaked file is a government one
A message that sounds like the tax office, the identity-document service or the police is easier to believe. That is why those files are valuable to scammers.
Read this guide
Health, school, and why leaked data ages badly
Some leaks look small because they are not passwords. Contact details, absences, and records tied to health or school stay useful to criminals for a long time.
Read this guide
When a machine writes the scam
Language models do not understand you. They predict the next word. That is already enough to write fluent, personal-sounding messages at a scale no call centre can match, especially once a leak has supplied the facts.
Read this guide
Passwords, passkeys, and what to change after a leak
A leaked password is useful because people reuse it. A hash is still a reason to change it. A passkey is harder to phish than a code sent by SMS.
Read this guide