Digital security
Data breach notification: what to do
Start with the official notice. Establish what was exposed and what action the affected organisation recommends.
Verify the notification.
Open the institution’s known website yourself or call its official number. Do not sign in through an unexpected message. Fraudsters may use a real breach as a pretext for contact.
- Establish which data was exposed and whether the notification concerns you.
- Keep the official notice, event date and any reference number.
If a password was exposed, secure the accounts.
Change the affected password and anywhere it was reused. Use a different password for every service. Check additional sign-in protection and recovery options.
- Review signed-in devices where available and report unknown activity to the provider.
- Keep recovery codes securely outside the phone. Do not give them to someone offering help.
Further informationCERT Polska: additional sign-in protection ↗Match further action to the exposed personal data.
An email address, password, Polish PESEL number and medical record need different responses. Follow the affected institution’s guidance. If a PESEL number was exposed, check the official restriction service.
- Do not send another identity document copy to an unverified caller.
- For an unknown transaction or disclosure of banking credentials, contact the bank immediately through its official channel.
Further informationPolish government: restrict your PESEL number ↗Distinguish a provider breach from a compromised device.
A breach notification does not prove that your phone was hacked. Do not install remote-access software simply because someone offers to check your data. Suspicious messages can be reported to CERT Polska.
- List affected accounts and the actions already taken.
- Continuing unknown logins or lost access may require account-provider support or a separately agreed investigation.
Further informationReport an incident to CERT Polska ↗