The short answer
A breach notification is a legal document written under time pressure, usually before the investigation is finished, and reviewed by counsel whose job is to avoid saying anything that later turns out to be wrong. The result is a text that is almost always technically accurate and nearly content-free.
It is still readable, because the constraints that make it vague also make it predictable. A handful of specific words carry real information, and the structure of what is omitted tells you as much as what is present.
Read the verbs
The single most informative thing in a breach notice is which verb describes what happened to the data.
- “Accessed” — someone with no authorisation opened it. This is a confirmed event.
- “Acquired” or “exfiltrated” — it left the building. This is worse than accessed and the word is chosen deliberately.
- “May have been accessed” — the investigators cannot rule it out. In practice this usually means logging was insufficient to prove otherwise, which is itself a finding.
- “Potentially affected” — the population is defined by what the attacker could have reached, not by what they demonstrably did.
- “There is no evidence that…” — the most important phrase in the genre. It is not a denial. It is a statement about the evidence available, and it is entirely compatible with the thing having happened without leaving traces. When a notice says “no evidence of misuse”, it is telling you nobody has reported fraud yet.
Read the dates, and do the subtraction
Three dates matter and you usually get two of them:
- When the intrusion began
- When it was detected
- When you were told
The gap between one and two is dwell time, and it is the honest measure of a security programme. Weeks is normal. Months means detection failed rather than prevention. If a notice gives you a discovery date but no start date, the investigation has not established one — meaning they still do not know how long the attacker was inside.
The gap between two and three is governed by law. Under GDPR, controllers must notify the supervisory authority within 72 hours of becoming aware, and affected individuals “without undue delay” where there is high risk to their rights. A notice arriving four months after discovery either concluded the risk was not high, or was delayed by a law-enforcement request, or represents a compliance failure. The notice will sometimes tell you which.
Read the data categories precisely
Notices enumerate categories, and small wording differences change your exposure enormously.
“Passwords were hashed” is meaningless without the algorithm. Bcrypt, scrypt or Argon2 with a proper work factor means offline cracking is expensive and slow. Unsalted MD5 or SHA-1 means the plaintext is effectively public for any password that is not long and random. Good notices name the algorithm. Most do not, and the omission is not accidental.
“Encrypted” requires knowing where the keys were. Data encrypted at rest with keys in the same compromised environment is not protected against an attacker who had that environment. The phrase to look for is confirmation that keys were held separately and were not affected.
“Partial card numbers” usually means the last four digits, which is low risk alone and quite useful to a social engineer combining it with other data.
“Contact information” sounds trivial and is the raw material for the phishing that follows. Combined with the knowledge that you are a customer of a specific institution, it is enough to make a convincing approach.
“Identity documents” — passport, national ID, driving licence scans — is the category that should worry you most. Unlike a password, you cannot rotate it, and it is what account-recovery processes are checked against for the rest of your life.
What is conspicuously absent
Notices rarely tell you the attack vector, and you can often infer the category from the remediation offered. “We have reset all user sessions” points at credential or token compromise. “We have engaged a third-party forensic firm and notified law enforcement” is boilerplate in almost every notice and tells you nothing. “The incident originated at a third-party service provider” is a supply chain compromise, and it means the vendor may have breached other customers you also use — worth watching for a second notice.
The number of affected individuals is often absent in the first notice and revised upward in later ones. Initial figures are floors, not estimates.
The first 48 hours
Change the password, and change it everywhere you reused it. If the breach included credentials, the reuse is the actual risk. The breached service will force a reset; the other twelve services with the same password will not.
Turn on the strongest second factor the account supports. If the choice is SMS or nothing, take SMS. If an authenticator app or passkey is available, take that instead — passkeys for banking covers why the difference matters.
Assume targeted phishing is coming, and that it will be good. The people contacting you will know you are a customer, may know your balance range or recent transactions, and will reference the breach itself as the pretext. The defence is procedural, not perceptual: never act on an inbound contact. Hang up, open the app yourself, or call the number on your card.
Freeze credit if identity documents or national identifiers were exposed. Mechanisms differ by country — a credit freeze, a fraud marker, or a voluntary block registered with the credit bureaux. It is free in most jurisdictions and it blocks the main monetisation path for stolen identity data.
Do not accept “we take security seriously” as the end of it. You have a right of access. You can ask the controller what specific data of yours was involved, and they must answer. The generic notice went to everyone; your file is individual.
Judging the response
Some notices are genuinely good, and the differences are visible.
A strong notice states what happened in plain terms, names the data categories precisely, gives the hashing algorithm, gives a timeline including the intrusion start date, explains what has changed structurally to prevent recurrence, and provides a route to ask about your own record specifically. It does not lead with an apology or with how seriously security is taken.
A weak notice leads with reassurance, uses “may have” throughout, describes data in categories broad enough to cover anything, offers credit monitoring as the substantive remedy, and never mentions the intrusion date.
Credit monitoring in particular is worth naming for what it is: a service that tells you after fraud has occurred. It is not prevention, it is a low-cost gesture, and its presence is not evidence of a serious response.
The structural point
A breach at a provider is not only about the data taken. It is evidence about how the organisation runs — whether it could detect an intrusion, how long that took, whether logging was adequate to answer the question afterwards, and whether it tells the truth under pressure.
That evidence is more durable than the incident. A company that discovers a breach in three days and describes it precisely is a better custodian afterwards than one that never had a breach and would not know. When you are deciding who to trust with an account, the response is the signal — which is why breach history is a field on every audit on this site, and why “none found” is recorded rather than assumed.