Why leaked data is useful to criminals

The leak writes the script

When criminals get a file of names, addresses, phone numbers, IBANs, school details or tax details, they are collecting facts they can read back to you.

A caller who knows your address, your operator, your child’s school or a contract number is not proving they work for that organisation. They have a copy of a leak, or enough of one to sound real.

What they want

Usually they are not emptying an account in one click. They want you to do something: click a link, read out a one-time code, approve a payment, send a document, or stay on the line while they connect to your bank.

Leaked data makes that conversation cheaper to run at scale. A generic “your parcel is waiting” scam is easy to ignore. A message that names the right ministry, the right telco, or the right airline loyalty programme is harder to dismiss.

It does not have to be a password

Many incidents in this dossier did not publish passwords. They still matter. Identity details, contact details, bank identifiers, tax figures and customer-service notes are enough to impersonate an official service.

If someone already has the facts an agency would know about you, “they knew my file” is not a reason to trust them. Hang up and open the official site yourself.

The news cycle ends. The data does not.

Stolen files are copied, sold and reused. A scam can arrive weeks or years after the original notice. Treating a breach as finished because it left the headlines is how delayed attacks work.