Recent UK breaches and scam waves have one thing in common: criminals often use stolen or leaked personal data to make their messages look more convincing. In May 2026, the National Cyber Security Centre (NCSC) updated its guidance for individuals after data breaches, and the ICO has also continued to penalise organisations for serious failures to protect personal data. (ncsc.gov.uk)
What happened
There is not usually just one “latest breach” affecting everyone. Instead, UK consumers are seeing a steady stream of separate breaches and scam campaigns, often followed by a wave of phishing emails, texts and phone calls that mention the breached organisation by name. The NCSC says criminals commonly exploit high-profile breaches while they are still fresh in people’s minds. (ncsc.gov.uk)
Recent UK examples include the Legal Aid Agency cyber incident, where the government said a large amount of personal data was accessed from applicants dating back to 2007, and the South Staffordshire Water incident, where the ICO said personal information belonging to 633,887 people was later published on the dark web. (gov.uk)
At the same time, the government and NCSC have warned about scams becoming more industrialised, including spoofed calls, scam centres overseas, and increasingly convincing phishing messages. The UK government announced a new fraud disruption unit and a 2026 to 2029 fraud strategy in March 2026, while the NCSC warned in March 2026 that AI-generated scams are likely to make fake emails and websites more convincing. (gov.uk)
Why it matters
If your data was exposed, the immediate risk is not only identity theft. It can also increase the chance of:
- phishing emails or texts that mention your real name, address or account details
- fake refund, compensation or “security check” messages
- attempts to reset passwords or take over accounts
- fraud using your personal details to build trust
The NCSC says even people whose details were not stolen can still be targeted because criminals use the publicity around a breach to trick others. (ncsc.gov.uk)
Who may be affected
You may be affected if you were a customer, user, applicant or employee of the organisation involved. The exact impact depends on what data was exposed. The NCSC says the organisation should confirm whether a breach actually happened, how you are affected and what you need to do next. (ncsc.gov.uk)
People are at greater risk if exposed data included:
- full name and contact details
- date of birth
- addresses or previous addresses
- government or account reference numbers
- passwords, security questions or payment details
If a notice only says “your data may have been involved”, treat that as a warning sign, but not proof. If the organisation has not confirmed the facts, say so in your own records and wait for an official update. (ncsc.gov.uk)
Warning signs that your data may have been exposed
Watch for any of the following after a breach or scam wave:
- messages claiming to be from the breached company, bank, HMRC or a delivery firm
- requests to “verify” your account, reset a password or confirm card details
- pressure to act quickly or threats that your account will be closed
- links that take you to a login page you did not expect
- phone calls that sound legitimate but ask for one-time passcodes or bank details
- unexpected log-in alerts, password reset emails or sign-in attempts
The NCSC defines phishing broadly as scam emails or texts that try to get you to reveal sensitive information or transfer money. (ncsc.gov.uk)
What to do now
If you think your details were exposed, take these steps straight away:
- Check the source. Look for an official notice from the organisation or regulator. Do not rely on social media posts or forwarded messages. (ncsc.gov.uk)
- Change passwords. If the breach involved an account you use elsewhere, change that password everywhere it is reused.
- Turn on two-step verification. Use app-based or device-based verification where possible.
- Watch your accounts. Check bank statements, card activity, loyalty accounts and email log-ins for anything unusual.
- Be wary of follow-up messages. The NCSC warns that scammers often exploit breach news with convincing fake contact. (ncsc.gov.uk)
- Report suspicious texts and emails. Forward suspicious emails to report@phishing.gov.uk and suspicious texts to 7726, which the government says is free. (gov.uk)
If the scam mentions HMRC, use HMRC’s reporting route rather than replying. HMRC says it will never email, text, message or call you to ask for personal or payment information in the ways scammers do. (gov.uk)
If you think your account has already been accessed, follow the NCSC’s advice for recovering a hacked account and, if your device seems infected, use the NCSC’s infected-device guidance. (ncsc.gov.uk)
How to stay safer next time
You cannot prevent every breach, but you can reduce the damage:
- use unique passwords for every account
- store passwords in a password manager
- switch on two-step verification wherever available
- keep your phone and apps updated
- be sceptical of urgent messages, especially after a breach is in the news
- never share one-time passcodes, even if the caller seems legitimate
The NCSC and government reporting services also make it easier to help block scams for other people. In 2026, the NCSC said the public had reported more than 10 million suspicious emails, helping take down tens of thousands of scam-related web pages. That shows reporting really does help, even when the message looks routine. (ncsc.gov.uk)
Key takeaway
If a breach or scam wave affects an organisation you use, act quickly but calmly: verify the notice, change reused passwords, enable two-step verification, watch for follow-up scams, and report suspicious messages through the official UK channels. (ncsc.gov.uk)
Sources
- NCSC: Data breach guidance for individuals
- NCSC: Data breaches
- GOV.UK: Avoid and report internet scams and phishing
- HMRC: Report suspicious emails, texts, social media accounts and phone calls
- GOV.UK: Legal Aid Agency data breach
- ICO: South Staffordshire data breach fine
- GOV.UK: New disruption unit launched in crackdown on fraud