Data breach at a company – what should you do?

You have received a message saying that your data has been leaked from a company – or you have read in the media about an attack on a service you use. Here is what you should do now.

Immediately

Check the message: fraudsters send fake “data breach warnings”. Do not click on links in the message; open the company’s website yourself instead.
Change your password: for the affected service and anywhere else you use the same password.
Turn on two-factor authentication wherever possible.
Payment details: if credit card details were affected, contact your bank or card issuer and have the card blocked if necessary.

Over the following weeks

Be careful with emails, text messages and calls: stolen data is used to launch particularly convincing fraud attempts (“phishing”). Never give out passwords or codes.
Keep an eye on your accounts: check your bank and credit card statements.
Check whether your address is affected: services such as “Have I Been Pwned” show whether your email address appears in known data breaches.
Identity misuse: if contracts are concluded or orders placed in your name, report it to the police.

Your rights

The company must report a data breach that is likely to result in a high risk to the Federal Data Protection and Information Commissioner (FDPIC) and inform you if this is necessary for your protection (Art. 24 FADP).
With an access request you can find out what data about you was stored.
You can request the deletion of data that the company no longer needs (template).
If you have suffered harm, you may be able to claim damages. Seek legal advice for this.

Reporting

You can report cyber incidents and fraud attempts to the Federal Office for Cybersecurity (NCSC). If a company breaches its obligations, you can inform the FDPIC (template).