Scammers hacked her phone and stole thousands of pounds

Information breaches are getting so widespread that it may be onerous to know learn how to react when it occurs to you. It is usually simple to shrug it off, however there is a threat.

Being a sufferer of an information breach will increase your probabilities of being focused by criminals and scammers.

Sue advised the BBC how scammers went after her. We discovered her particulars had been leaked on-line.

She was a sufferer of what is often called a Sim swap assault – the place scammers trick a community operator into considering they’re the account holder to get a brand new Sim card for a cellular system.

They used it to take over nearly all her on-line accounts by way of her cellphone. She stated the expertise was “horrible”.

“The scammers took over my Gmail account after which locked me out of my financial institution accounts as a result of they failed safety checks,” she stated.

Sue additionally had a bank card opened in her identify and the criminals bought greater than £3,000 in vouchers.

It took a number of journeys to the branches of her financial institution and cell phone supplier to get her accounts again.

And the thieves weren’t finished.

“The criminals additionally did a sinister factor after breaking into my WhatsApp,” she stated. “They despatched messages to horse driving teams I’m in warning there have been individuals on their solution to stab the horses.”

We searched hacker databases utilizing on-line instruments like haveibeenpwned.com and Constella Intelligence to see if Sue’s particulars have been beforehand compromised.

Her cellphone quantity, electronic mail handle, date of start and bodily handle have been all uncovered in knowledge breaches at playing platform PaddyPower in 2010 and electronic mail validation software Verifications.io in 2019. Different compilations of hacked data additionally included her particulars.

Hannah Baumgaertner, from cyber agency Silobreaker, stated attackers doubtless used the private knowledge leaked in earlier breaches to conduct the Sim swap assault.

“As soon as they’d entry to Sue’s cellphone quantity they have been have been in a position to intercept any safety codes despatched to confirm her identification for her Gmail account,” she stated.

However scammers aren’t all the time focusing on huge payouts.

Fran from Brazil advised the BBC she discovered a consumer had registered to her Netflix account – and elevated her month-to-month subscription.

“I used to be charged $9.90 (£7.50) on my fee card, despite the fact that I hadn’t made this buy,” she stated.

“I instantly contacted my household to search out out if anybody had added one other profile to the account we share, however all of them stated no.”

Fran was a sufferer of a standard rip-off the place her Netflix account was hijacked by a freeloader.

It isn’t identified precisely how they obtained into her account and the murky world of cybercrime means it’s tough to pinpoint if a single knowledge breach led to somebody being scammed.

However we discovered Fran’s electronic mail handle had been uncovered in at the very least 4 knowledge breaches together with hacks of Web Archive (2024), Trellov (2024), Descomplica (2021) and Wattpad (2020) in accordance with the web site haveibeenpwned.com.

The password she used for her Netflix account shouldn’t be in publicly identified databases however could be in others.

“There’s a big marketplace for cracked Netflix, Disney and Spotify accounts”, stated Alon Gal, co founding father of cyber safety firm Hudson Rock.

“It is a low-barrier entry level for cybercrime, turning one firm’s knowledge leak into widespread, ongoing abuse.”

Scammers usually mix stolen non-public info with public info.

Leah, who did not need to give her actual identify, runs a small enterprise utilizing Fb adverts and was just lately focused in a protracted operating rip-off apparently originating from Vietnam.

“I obtained a phishing electronic mail from ‘notifications@facebookmail.com’ saying that I used to be due a refund. I clicked on the hyperlink and entered my particulars on the pretend Meta web page and the scammers have been in a position to take over my enterprise account despite the fact that I had 2 issue authentication.

“They then posted youngster sexual abuse movies beneath my identify which obtained me blocked. I used to be even barred from utilizing Messenger to complain to Meta.”

Within the three days it took Leah to get again her enterprise account again the scammers had run tons of of kilos of adverts paid for by her. She finally obtained the cash again.

Alberto Casares from Constella Intelligence searched hacker databases and located Leah’s electronic mail handle and different particulars have been taken in knowledge breaches at Gravatar (2020) and this yr’s Qantas (third-party breach).

“It seems just like the attackers used a standard strategy of linking up Leah’s non-public stolen electronic mail handle along with her publicly listed enterprise quantity to launch a focused phishing assault towards the e-mail account.”

They might have finished this themselves or used an information dealer to pay for a variety of potential targets he stated.

Mass knowledge breaches are fuelling scams and secondary hacks world wide, with a number of excessive profile assaults coming in 2025 alone.

In keeping with Proton Mail’s Information Breach Observatory, there have been 794 verified breaches from identifiable sources found up to now in 2025 with greater than 300 million particular person data uncovered.

“Criminals pay premium costs for stolen knowledge as a result of it persistently generates revenue by way of fraud, extortion, and cyberattacks,” stated Eamonn Maguire from the agency.

Except for notifying prospects and regulators about breaches, there aren’t any onerous and quick guidelines on what firms ought to do for victims.

Providing free credit score monitoring, for instance, was widespread.

Last year, Ticketmaster (which noticed 500m individuals affected by a breach) provided this to some individuals.

However this yr fewer companies are doing this. Marks and Spencer and Qantas, for instance, haven’t provided these providers to prospects.

Co-op selected to present victims a £10 voucher – in the event that they spent £40 in its retailers.

Some try to hunt compensation within the courts, with a rising pattern of sophistication motion lawsuits – although these are notoriously onerous to win as a result of it’s tough to show how people have been impacted.

However some have been profitable.

T-Cell has begun paying prospects affected by a serious knowledge breach in 2021 which affected 76m prospects.

The agency agreed to pay $350m – with funds reportedly starting from $50 to $300.

Get our flagship publication with all of the headlines you’ll want to begin the day. Sign up here.