A Vague Data Breach Notice Still Tells You What to Do Next

According to ESET, a data breach notice in your inbox or mailbox this year is less likely than ever to say what actually happened. Treat a vague notice as the baseline, not the exception, and act anyway.

Publicly reported data breaches hit an all-time high in the US last year, with over 3,300 incidents recorded and nearly 280 million victim notices mailed out. The non-profit Identity Theft Resource Center found that over 471 million victim notices went out in just the first half of 2026. Only 24% of those notices contained details about how the attack happened, the lowest rate the ITRC has ever recorded. Three-quarters of victims say they want a plain-language list of exactly what data was taken. Most will not get one.

Read the wording, not just the headline

The words a company chooses matter more than the reassurance it offers. If a notice says your data was “accessed”, that is not the same as “exfiltrated”, meaning actually taken. A company that says it has seen “no evidence of misuse” is describing what it has detected, not what is happening on criminal forums it cannot see. And “may have been affected” does not confirm your data was in the breach at all. None of these phrases is a lie. All of them tell you less than they sound like they do.

What a vague notice means for you

A notice that withholds the attack method still confirms one fact that matters: an organisation holding your data lost control of some of it. That is enough to act on. The absence of detail is not a reason to wait for more information before doing anything, because fuller detail, if it comes at all, may take weeks or months to arrive. Treat the notice as a trigger, not a verdict.

What to actually do

• Change the password for the breached account immediately, and for any other account reusing that password.
• Turn on two-factor authentication wherever it is offered, on the breached account and on email.
• Watch bank and card statements for unfamiliar charges, especially small ones that test a card before a larger one follows.
• Treat “no evidence of misuse” as a current snapshot, not a guarantee, and keep checking for weeks after the notice arrives.
• If the notice does not say what data was taken, assume it includes anything that account typically stores: name, email, password, and payment details if the service holds them.

The notice will not do the risk assessment for you. Reading the exact wording, rather than the reassuring tone around it, is the only way to know what to check first.