Usually from indirect signs: a wave of personalised phishing, text messages about login attempts and credit inquiries in BIK (the Polish credit bureau) that you never made. You can check an email address at haveibeenpwned.com. If you get a text message about a leak, do not tap the link: open the company’s website by typing the address yourself.
The company will not always tell you
A data controller must notify you of a leak without undue delay when the incident is likely to result in a high risk to your rights. It does not have to if, for example, the data was encrypted. When a very large number of people are affected, it may publish a public notice instead of writing to each of them. So notice of a leak may come late, be vague, or never arrive.
Signs to watch for
- emails and text messages with your name, surname or an order number, sent by senders you have no connection with,
- verification codes and login alerts you did not trigger,
- credit inquiries in your BIK report that you never made (the paid BIK Alerts service sends a text message for every such inquiry),
- calls from a supposed bank or police officer who knows your PESEL (Polish national identification number) or address.
The haveibeenpwned.com service collects known leaks of email addresses, including old ones. Enter your address and it shows which service the leak came from and what data it included: just the password, a phone number or a home address.
A text about a leak: warning or trap
A message along the lines of “Your data has leaked, check here” is a common scam. The leak itself may be real, while the link leads to a fake page that asks you to log in or enter card details. Do not open the link from such a message, even if you have heard about the leak in the news. Type the company’s or bank’s address by hand and look for the notice there. An organisation notifying you of a leak does not need your password, PIN or a code from a text message.
When the signs are confirmed
If your PESEL has leaked, restrict it (zastrzeżenie PESEL) in the mObywatel app, on gov.pl or at a municipal office. Banks and lenders must check the restriction before granting credit. Change your password wherever you used the one that leaked, and turn on two-step verification. After that come monitoring your credit history, watching for phishing tailored to the leak and, if someone has used your data, reporting it to the police.
Topics
Put your most important documents in one secure place
Sejf Życia is an encrypted space for documents, access details and instructions for loved ones. Only you decide who gets access, and when.