Countless businesses, schools, hospitals, and governments have found out the hard way what it means to rely on a single company’s systems to get things done. And next time could be even worse.
Mavis Tire Supply LLC, the company behind Mavis Discount Tire, has disclosed a data breach involving Social Security numbers, government ID numbers, financial account information, and health records. The company reported the breach to the Vermont Attorney General on November 3, 2026, and is notifying affected people by mail.
The breach is more than a year old. Mavis says it detected unauthorized access on June 18, 2025, according to the sample notification letter it filed in Massachusetts, and the Worldleaks ransomware group claimed the attack that September. Now that letters are in the mail, the next risk is scammers who copy them to collect the same information that was exposed.
What Happened in the Mavis Tire Data Breach?
Mavis says it detected unauthorized access to its IT environment on June 18, 2025. According to the company’s sample notification letter, a “criminal third party had copied certain data,” and Mavis brought in outside counsel and a forensics firm to review what was taken.
On September 23, 2025, the Worldleaks ransomware group claimed the attack, according to HookPhish. Mavis reported the breach to the Vermont Attorney General on November 3, 2026, about 16 months after it detected the intrusion, and listed 85 Vermont residents in that filing.
The letter does not explain why notification took that long, and it says Mavis is “not aware of any misuse” of personal information.
What Did the Worldleaks Ransomware Group Take?
Mavis has not said what Worldleaks took, and the group’s claim is not proof of what it holds. The best public record of what was exposed is the list of data categories Mavis filed with state regulators.
What Data Was Exposed in the Mavis Discount Tire Breach?
The Vermont filing lists five categories of data, including health records. Each letter lists the specific information Mavis found for that recipient.
Data Category
Why It Matters
Social Security numbers
Can be used to open credit, file a tax return, or claim benefits in your name.
Government ID numbers
Can help a scammer pass identity checks or impersonate you.
Financial account information
Can be used to target your bank accounts or make phishing messages more convincing.
Credit and debit account information
Can lead to unauthorized charges.
Health records
Can be used for medical identity theft, such as bills or insurance claims for care you never received.
Was My Information Exposed in the Mavis Discount Tire Breach?
A notification letter from Mavis is the clearest way to know. The sample letter says the recipient’s personal information “was found during this review” of the copied data, and it lists the types of information involved for that person.
If you shopped or worked at Mavis and have not received a letter, that does not rule you out, because filings are still coming in. Mavis has not posted a public statement on its social accounts. Watch your mail for a notification letter, and do not use “check my name” breach sites that ask for your Social Security number.
Is the Mavis Tire Breach Notification Letter Real or a Scam?
A real Mavis letter arrives by mail and offers free identity monitoring through a code printed on the letter. A fake data breach letter typically copies that wording and changes the link, the phone number, or what it asks you to send.
Offer: 24 months of identity monitoring through Kroll “at no cost to you”
Enrollment: at enroll.krollmonitoring.com, using a membership number printed on the letter
Support line: (844) 301-0180, Monday through Friday, 9 a.m. to 6:30 p.m. Eastern
Deadline: an activation date printed on the letter
If a message differs from these details, or if someone reaches you by text, email, or phone call, don’t respond to it. Type the enrollment address into your browser yourself instead of scanning a QR code or tapping a link.
Red Flags of a Fake Data Breach Letter
Red Flag
Why It Matters
A fee to “activate” protection or “secure” your data
The monitoring Mavis offers is free. Any payment request points to a scam.
A request for your full Social Security number, card number, or bank login
Enrollment uses the membership number on your letter. A scammer who already has part of your data may ask you to “confirm” the rest.
Contact by text, email, social media, or phone
Mavis is notifying people by mail and has not posted about the breach on social media.
A link, QR code, or phone number that doesn’t match the details above
Copying a real letter and swapping the contact details is a tactic to redirect you.
A deadline of hours, or a threat of legal trouble
Pressure keeps you from verifying. The real letter gives you until a printed activation date.
What Should I Do If I Got a Mavis Tire Data Breach Notification Letter?
Enroll in the free monitoring and freeze your credit. Those two steps cover the biggest risks from an exposed Social Security number, and the rest of this section depends on what your letter says was exposed.
Enroll in the monitoring before the deadline on your letter. Use the enrollment address and membership number printed on it.
Freeze your credit at Equifax, Experian, and TransUnion. A freeze is free, doesn’t affect your credit score, and lasts until you lift it. It stops most lenders from opening new accounts in your name.
Check your credit reports. The FTC points to AnnualCreditReport.com for free reports from all three bureaus. Look for accounts, addresses, or inquiries you don’t recognize.
Treat follow-up messages about the breach with caution. Use the checks above before you respond to anything that mentions Mavis.
If Your Social Security Number Was Exposed
There’s no single switch to lock a Social Security number, but two steps cover the most common misuse: new credit and tax refund fraud.
Freeze your credit (step 2 above), or at least place a fraud alert. The FTC says an initial alert lasts one year and can be renewed.
Get an IRS Identity Protection PIN. This six-digit number from the IRS stops anyone else from filing a tax return with your Social Security number. It is valid for one calendar year, and the IRS will never ask you for it.
Create a my Social Security account at ssa.gov/myaccount to review your earnings record and watch for unusual activity.
If Your Health Records Were Exposed
Medical identity theft shows up in bills and insurance paperwork, not credit reports. The FTC lists a bill or Explanation of Benefits “for services you didn’t get” as a warning sign.
Read every Explanation of Benefits from your insurer. Look for visits you didn’t make and services you didn’t receive.
Report errors to your health care provider in writing, and call your insurer about claims you don’t recognize.
What to Do If Your Information Has Already Been Misused
If you find accounts, charges, tax filings, or medical claims you didn’t make, act on them in this order.
Call your bank or card issuer to stop or reverse unauthorized transactions and close compromised accounts.
Report it at IdentityTheft.gov. You’ll get an FTC Identity Theft Report and a personal recovery plan.
Place an extended fraud alert. The FTC says it lasts seven years and requires an identity theft report.
Dispute fraudulent accounts with Equifax, Experian, and TransUnion, and send each a copy of your identity theft report.
Contact the IRS through irs.gov if someone filed a tax return in your name.
File a police report if you lost money, and keep the report number.
Keep records of every letter, call, case number, and date.
How to Report a Fake Breach Notice or Identity Theft
Reporting helps authorities track scams that piggyback on the breach and puts your case on record.
FBI Internet Crime Complaint Center (IC3): Report online fraud and money lost at ic3.gov.
Your state attorney general: Report scams to your state’s consumer protection office.
Local police: File a report if you lost money or were threatened.
The Mavis Tire data breach unfolded slowly with notification letters going out more than a year after the 2025 attack. That delay means the exposed data has been out of Mavis’s control for a long time, and the letters arriving now give scammers a fresh pretext. The defense is the same either way: freeze your credit, and verify every message about the breach before you act on it.
Mavis Tire Data Breach FAQ
How can I tell whether my data is on the dark web after a breach?
You usually can’t confirm what a criminal group holds. Treat a notification letter as the signal, and act as if your information is exposed: freeze your credit, get an IRS Identity Protection PIN, and watch your reports and statements.
Does a credit freeze protect my health records?
No. A freeze stops new credit accounts, but it doesn’t stop someone from using your insurance or medical information. Review each Explanation of Benefits and report services you didn’t receive.
Amplifon Americas, a U.S. hearing care provider, has disclosed a data breach that affects 1,332,826 people nationwide, according to a Texas Attorney General filing as summarized by BreachTally on Nov. 6, 2026.
Amplifon’s security incident notice says the exposed data includes names, dates of birth, government ID numbers, and health and insurance information, and that Social Security numbers or financial information were affected for a limited number of individuals. Amplifon has not publicly confirmed the total, and the company says it is not aware of any fraudulent use of the information.
How the Amplifon Data Breach Happened
An unauthorized third party obtained files from Amplifon’s systems between Jan. 18 and Feb. 8, 2026, according to the company’s notice. Amplifon says it detected suspicious activity on Feb. 11, 2026, notified law enforcement, and disabled impacted accounts.
The notice says a review of the affected data indicated on Oct. 6, 2026 that certain personal information may have been impacted. That is nearly eight months after detection, and the notice does not explain the timeline. Amplifon says it will notify people for whom it has a valid mailing address, and its Texas filing lists U.S. Mail and a website posting as the methods of notice.
Amplifon has not said how the attackers got in. As of Nov. 9, The Record reported that no hacking group had claimed responsibility. Amplifon also filed notices with state officials, including in Texas and Vermont. The Texas Attorney General’s breach report listing, published Nov. 6, 2026, shows 85,804 Texans affected.
What Information Was Exposed in the Amplifon Data Breach
What was exposed varies by person, and your notice letter lists which of your information was involved. Amplifon’s notice names these categories:
Names and contact information
Dates of birth
Driver’s license, state ID, or other government-issued ID numbers
Hearing or medical information, including medical record numbers, dates of service, and other health information
Health insurance ID numbers and related information
According to Amplifon, Social Security numbers or financial information “may also have been impacted” for “a limited number of individuals.” The Vermont Attorney General’s breach notice listing for Amplifon names Social Security numbers and health records, and the Texas listing includes Social Security number information among the types affected.
What Can Someone Do With Your Social Security Number?
Criminals can use a Social Security number to try to open new credit accounts in your name, which a credit freeze blocks, or to file a tax return in your name, which the IRS Identity Protection PIN is designed to prevent. Health insurance and medical record details add a separate risk: medical identity theft, which happens when someone uses another person’s information to obtain medical care.
Amplifon says it is not aware of fraudulent use so far. The steps below apply whether or not any misuse has shown up.
What Should You Do If You Got an Amplifon Data Breach Notice?
Read the notice closely, confirm it is genuine, and note which of your information it says was involved. Amplifon’s Texas filing shows that notice was provided by U.S. Mail and a website posting, and the company’s notice says it will notify people for whom it has a valid mailing address.
Check that the toll-free number on the letter matches (844) 971-8634, the number on Amplifon’s official notice page. Do not reply to unsolicited calls, texts, or emails about the breach.
Note which categories of information the letter lists, especially Social Security number, financial, and medical information.
Keep the letter and envelope, with the date you received them.
If the letter offers credit monitoring, enroll through the instructions in the letter, not through links in unsolicited texts or emails.
If you used Amplifon hearing care services and did not get a letter, call the hotline on the notice page to ask whether your information was involved. The notice says Amplifon will notify people with a valid mailing address, so a missing letter does not by itself show that your information was not involved. The steps below apply either way.
Warning Signs That Your Information Is Being Misused
Signs of misuse tend to appear in your credit reports, your medical and insurance statements, and the messages you receive.
Warning Sign
Why It Matters
An Explanation of Benefits for care you did not receive
A medical debt collection notice you do not recognize
The FTC advises checking credit reports for unfamiliar medical collections after a medical identity theft.
Accounts or credit inquiries you did not open
Someone may be using your identity details to seek new credit.
A call, text, or email about the breach that asks for your SSN, payment, or login details
Messages about a breach can be copied by scammers. Use the phone number on your letter or on Amplifon’s official notice page instead.
How to Protect Yourself After the Amplifon Data Breach
Start by confirming what was exposed, then block new credit in your name and watch your accounts and statements.
Read your notice letter and use official contact details. Note which categories of information it lists. Do not reply to unsolicited calls, texts, or emails about the breach. Contact Amplifon only at the number on your letter or the toll-free line, (844) 971-8634, on its official notice page.
Enroll in the credit monitoring Amplifon offers, if your letter includes it. Amplifon says it is offering 24 months of free credit monitoring and identity protection services to certain individuals, including those whose SSN or financial information was affected.
Freeze your credit at all three bureaus. A freeze blocks new credit accounts in your name. Details are in the next subsection.
Request an IRS Identity Protection PIN. The IRS says this six-digit number prevents someone from filing a tax return with your SSN.
Review statements and credit reports. Look for Explanations of Benefits for care you did not receive, and request your credit reports at AnnualCreditReport.com to check for accounts you do not recognize.
Should You Freeze Your Credit After the Amplifon Breach?
Yes, if your notice says your SSN or financial information was involved. The FTC says there is no cost to place or lift a freeze, and that while one is in place nobody can open a new credit account in your name, including you. A freeze does not close existing accounts.
Place the freeze separately at Equifax, Experian, and TransUnion. A free fraud alert, which lasts one year, is a lighter option, but unlike a freeze it does not block lenders from viewing your report.
What to Do If Your SSN or Medical Information Was Misused
If your notice says your SSN was involved, or you see signs of misuse, freeze your credit first, then work through these steps.
Report identity theft at IdentityTheft.gov. The FTC directs people there to create a personal recovery plan, and the Social Security Administration says to report a stolen SSN to the FTC if you believe your identity was misused.
Contact your bank or card issuer if your notice says financial information was involved, and ask about stopping or reversing charges you do not recognize.
Dispute errors. If statements show care you did not receive, request records from each provider, insurer, and pharmacy involved and report errors in writing. The FTC says providers must respond within 30 days. Dispute unfamiliar accounts and medical collections with the credit bureaus.
Keep records. Save your notice letter, call dates, reference numbers, and copies of anything you send.
FBI Internet Crime Complaint Center: Report phishing messages or other internet-enabled fraud at ic3.gov.
Local police: File a report if you lost money or someone used your identity.
Amplifon: Call the toll-free line on your notice letter with questions about your notice.
Amplifon disclosed the breach in early November 2026, and more details may emerge as the company and regulators release information. Whatever your letter says, the most important protective step is a credit freeze at Equifax, Experian, and TransUnion, because it blocks new accounts opened with exposed identity details.
FAQ
Was Amplifon hit by a data breach, and how many people were affected?
Yes. Amplifon says an unauthorized third party obtained files from its systems between Jan. 18 and Feb. 8, 2026, and that it detected suspicious activity on Feb. 11. BreachTally’s summary of the Texas filing lists 1,332,826 affected people nationwide, a total Amplifon has not publicly confirmed. The Texas Attorney General’s listing shows 85,804 Texans affected.
What information was exposed in the Amplifon data breach?
Amplifon’s notice lists names, contact information, dates of birth, driver’s license and other government ID numbers, health and medical information, and health insurance information. Social Security numbers or financial information were affected for a limited number of individuals, according to the company.
Why did it take Amplifon months to notify people?
Amplifon has not publicly explained the timeline. Its notice says a review of the affected data indicated on Oct. 6, 2026 that certain information may have been impacted, nearly eight months after the Feb. 11 detection.
Does Amplifon offer free credit monitoring, and should I still freeze my credit?
Amplifon says it is offering 24 months of free credit monitoring and identity protection services to certain individuals, including those whose SSN or financial information was affected. Monitoring and a freeze do different jobs: monitoring alerts you to activity, while a freeze blocks new accounts from being opened in your name.
DeepMind researchers were able to formally verify that the widely used encryption protocol works as intended. Their stretch goal? Do the same for “all the software of the world.”
Google and a group of security partners said on Nov. 2, 2026, that they had dismantled XCPE, a botnet hidden inside more than 1.3 million TV set-top boxes, most of them inexpensive Android TV boxes. According to Google’s Threat Intelligence Group, the device maker Videostrong Technology Co. built the backdoor into the boxes and sold access to criminals, who used owners’ home internet connections for ad fraud and residential proxy networks. The servers that controlled the botnet are down, but the backdoor is still on the boxes, and owners cannot remove it themselves.
Key points
The backdoor, called x.cpe, sits in the box’s firmware and reinstalls itself if you delete it.
Google attributes it “with high confidence” to Videostrong Technology Co.
Google says the takedown also cuts criminals off from at least 10 million other infected devices.
If your box is affected, disconnect it and plan to replace it. A factory reset may not remove the backdoor, which lives in protected firmware.
A hidden system app. A small program named x.cpe (com.oemservice on some boxes) is preloaded in the firmware with system-level access. If a user uninstalls it, it reinstalls itself from a protected part of the firmware the next time the box restarts.
A remote control channel. The backdoor checks in with the operators’ servers and waits for orders. Through it, the operators could install apps silently, run commands, capture the screen, and map the home network. Before installing anything, it switched off Google Play Protect’s app checks.
Paid add-ons for criminals. Videostrong sold access to other criminal groups and loaded their programs onto the boxes. Most of these turned the box into a residential proxy or used it for bandwidth sharing, which rents out your home internet address so someone else’s traffic appears to come from your house. Others faked ad views or loaded other malware.
Google says it saw the operators take live screenshots, inject keystrokes, and copy account details, device information, app lists, and system logs from infected boxes. Google ties two of the add-on programs, Moyu and Bird, to the BadBox operation. The FBI warned consumers about that operation, known as BADBOX 2.0, in a June 2025 public service announcement.
Most infected devices were Android TV set-top boxes, but Google also found the backdoor on telehealth devices, karaoke machines, and digital signage. (For more background on this kind of threat, see our explainers on backdoor attacks and pre-installed malware on Android devices.)
Google says it used legal action to take down the botnet’s control servers and the control domains of more than a dozen malware families. It also banned Videostrong and any future subsidiaries or affiliates from making certified Android devices or supplying software to other certified vendors. Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient, and TrendAI worked with Google on the operation, according to Google’s report.
Is My Android TV Box Affected?
There is no single test, but these checks will tell you whether your box is likely part of XCPE. Work through them in order.
Check the brand and model. Researchers at Synthient and Plume link MECOOL-branded boxes to Videostrong, and Synthient found the backdoor already installed on a MECOOL KM9PRO Max it bought. Synthient has published a list of 182 device model names seen in the campaign. A match is a strong warning sign, not proof: the list itself says a model name alone does not confirm infection. A box that is not on the list is not automatically safe, because Videostrong also makes boxes sold under other brands.
Look for the backdoor app. On the box, open Settings, then Apps, and choose the option to show system apps. If you see x.cpe, com.oemservice, or com.abc.nexus, treat the box as infected. These are the package names Google published. Not finding them does not clear the box: since August 2026, the operators have also installed extra apps disguised as Android system apps, with names such as com.android.system.ntp.
Check whether Play Protect was turned off. The XCPE backdoor disables Google Play Protect’s app checks. If you find Play Protect’s app scanning switched off and you did not turn it off, treat that as a red flag.
Watch your home network. The FBI lists unexplained internet traffic as a possible sign of an infected device. Check your router’s app or admin page for heavy data use by the TV box, especially when nobody is watching anything.
Warning Signs Your TV Box Is Part of a Botnet
Red flag
Why it matters
The box was sold as “unlocked” or able to access free content
The FBI lists this as a possible sign of a compromised device
The brand is one you do not recognize
The FBI lists unrecognizable brands as a possible sign of a compromised device. Videostrong also makes boxes for other brands, so its firmware can ship under names you may not know
Google Play Protect is off and you did not turn it off
XCPE disables Play Protect’s app checks so it can install software silently
Apps appear that you never installed
The backdoor can install apps without asking
Heavy internet traffic from the box while it sits idle
Proxy software sends other people’s traffic through your connection
Settings change on their own
The operators can run commands on the box remotely
Doesn’t Play Protect Certification Protect Me?
Not in this case. Google requires device makers to pass compatibility and security tests before they can ship Google’s apps, but Google says Videostrong hid its code to get through a gap in those tests and loaded the malicious parts only after the box first started up. Plume found both Google-certified boxes and uncertified boxes in the botnet. Google has not said how many certified devices were affected.
Google says it has changed its review process and is improving how it checks firmware on certified Android TV devices. Certification is still worth checking for, but it is not proof that a particular box is clean, so check the other signs above as well.
What to Do If Your TV Box Is Affected
Unplug it from your network. Remove the Ethernet cable and forget your Wi-Fi network on the box, or simply power it off. This stops your connection from being used as a proxy and cuts the operators’ access to your home network.
Don’t count on a factory reset. The backdoor lives in the box’s firmware, which a reset does not replace, and it reinstalls itself after it is deleted. Plume suggests a full reset to clear any extra programs the operators added, but researchers disagree on whether any home fix works: TrendAI says cleanup needs vendor action, platform protection, or replacement of the device, and Synthient advises throwing these boxes away.
Replace the box. Contact the seller or marketplace and ask about a return or refund, and keep your receipt, order details, and the model number. Recycle the old box as electronic waste rather than passing it on to someone else.
Change passwords for accounts you used on the box. That includes streaming services, your Google account, and any other app you signed in to. Google observed the operators capturing screens, injecting keystrokes, and copying account details, so assume anything typed on the box may have been seen. Turn on multi-factor authentication where it is offered.
Secure your router. Change your Wi-Fi password and the router’s admin password, and remove any devices you don’t recognize. If your router supports a guest network, put streaming boxes and other smart devices on it, apart from your computers and phones.
Watch your accounts. Look out for login alerts, password-reset emails you didn’t request, or charges you don’t recognize. If you entered payment details on the box and see charges you didn’t make, call your bank or card issuer. If someone opened accounts or used your identity, report it and get a recovery plan at IdentityTheft.gov.
How to Buy a Safer Android TV Box
Google recommends buying set-top boxes only from reputable manufacturers, and it keeps a list of its Android TV partners you can check before you buy. Skip boxes sold as “unlocked” or able to access free content, which the FBI lists as a possible sign of a compromised device. Once the box is set up, keep Google Play Protect on, install apps only from official app stores, and pass on any app that offers to pay you for your unused bandwidth. Google says those apps are one of the main ways illicit proxy networks grow.
How to Report It
FBI Internet Crime Complaint Center: If you think a device on your network was used for criminal activity or someone got into your accounts, file a report at ic3.gov.
Federal Trade Commission: Report a seller or marketplace listing that sold you an infected device at ReportFraud.ftc.gov.
The seller or marketplace: Report the listing so others don’t buy the same device.
Local police: File a report if you lost money.
Google warns that when one part of this criminal supply chain is disrupted, operators quickly switch to new loaders and tools. If your TV box matches the signs above, unplug it and replace it rather than waiting for a fix.
Revolve Group, the online fashion retailer, says hackers may have obtained names, contact information, payment card numbers, and expiration dates from customers who saved a card to their online shopping accounts, according to the company’s October 29, 2026, SEC filing. Revolve’s breach report to the Texas attorney general lists 1,515,073 people affected, though Revolve has not confirmed that total in a public statement.
If you saved a card with Revolve, your most urgent next step is to ask your card issuer for a new card number. Revolve is not offering free credit monitoring, so affected shoppers will need to be vigilant and closely monitor their own statements and credit reports for signs of misuse.
What Happened in the Revolve Data Breach
An unauthorized actor got into certain Revolve systems and used “automated means” to pull saved customer payment details, Revolve said in its 8-K. The company said it notified federal law enforcement, brought in outside cybersecurity experts, has remediated the activity, and is putting enhanced security measures in place. It reported no operational disruption and said it does not expect a material impact on its business.
The SEC filing gives no dates or victim count. Those came from state breach notices. Revolve’s Texas filing lists September 11, 2026, as the date of the breach and September 29, 2026, as the date Revolve discovered it. The Texas filing also listed 127,200 affected Texans and 1,515,073 total affected shoppers.
Revolve breach timeline
Date (2026)
What happened
Sept. 11
Date of breach, per Texas AG records
Sept. 29
Revolve discovers the incident
Oct. 29
Revolve files an 8-K with the SEC; customer notices begin
Oct. 30
8-K posts publicly on EDGAR; Texas AG publishes Revolve’s breach report, listing 127,200 Texans and 1,515,073 people in total.
What Data Was Stolen in the Revolve Breach
The stolen data covers customers who had saved payment information to their Revolve shopping accounts. According to the 8-K, it includes:
Full name
Contact information, including address
Payment card number
Card expiration date
Neither the SEC filing nor the Massachusetts letter lists CVV security codes, Social Security numbers, or passwords. That limits some misuse, but a card number paired with a name, address, and expiration date still has value to criminals. McAfee Labs has tracked how this kind of data is sold. As our guide to how stolen data travels through the internet (April 2026) explains, a stolen credit card number might sell for just a few dollars, while a more complete identity profile can go for about $50.
Got a Revolve Data Breach Letter? What It Means and What to Do
A Revolve breach letter means a card you saved on Revolve was in the stolen data, and that card is the one to replace. Revolve’s notification letter filed with Massachusetts names the affected card by its last four digits and lists:
What was taken: your name, address, card number, and expiration date
Contact details for Equifax, Experian, TransUnion, and the FTC
A Revolve call center at 888-517-6458, Monday through Friday, 9 a.m. to 9 p.m. ET, excluding some major U.S. holidays
The letter does not offer credit monitoring, and it does not ask you to enter card details on a website. If a letter, email, or text about the Revolve hack asks for your card number, CVV, or a payment, treat it as a scam and contact Revolve through revolve.com or the number above.
How Do I Know If My Credit Card Has Been Compromised?
The clearest signs are charges you don’t recognize, a notice from your card issuer, or a breach letter from Revolve. Watch for these red flags over the coming months, not just this week:
Red Flag
Why It Matters
Tiny charges of a few cents or dollars from unfamiliar merchants
Criminals run small “card testing” charges to confirm a stolen card works before using it for bigger purchases
Purchases, subscriptions, or declined transactions you didn’t make
A declined attempt can mean someone tried your number and failed
Emails or texts about the Revolve breach that link to a “verify your card” or refund page
Scammers use breach news to collect the CVV and other details this breach didn’t expose
Calls claiming to be from Revolve or your bank asking for your full card number, CVV, or a one-time code
Revolve and card issuers already have your card details and don’t need you to read them back
Messages that know your name and address and push you to act fast
The stolen data makes phishing look more convincing
Saved a Card on Revolve? Replace It and Take These Steps
If you saved a card on revolve.com or in the Revolve app, treat that card number as exposed. These steps apply whether or not you’ve received a letter yet:
Ask your card issuer for a new card number. Call the number on the back of your card and say the card was exposed in the Revolve breach. A new number makes the stolen one useless.
Remove saved cards from your Revolve account. Delete stored payment methods, then add a new card only at checkout if you continue shopping there.
Check your last three months of statements. Look for any charge you don’t recognize since the September 11, 2026, breach date, including small ones from merchants you don’t know.
Turn on transaction alerts. Most card issuers can text or email you for every purchase, which flags a test charge the day it happens.
Verify any breach letter before you act on it. Revolve’s notification letter filed with Massachusetts lists a call center at 888-517-6458. Call that number, or go to revolve.com directly, instead of using links or phone numbers in an email or text.
Revolve’s 8-K says the stolen payment data relates to certain customers who saved payment information to their accounts. If you shop at Revolve but never saved a card, your card number was likely not exposed. You likely don’t need a new card, but watch for phishing that uses the Revolve name, since the breach is now widely reported.
What to Do If You’ve Already Seen Fraudulent Charges
If you spot charges you didn’t make, report them to your card issuer right away and follow up in writing. When only your card number was stolen, you aren’t responsible for unauthorized credit card charges, according to the FTC.
Debit cards carry more risk. Fraud drains your bank account directly, and you’re protected only if you report the charges within 60 days after your statement is sent.
Dispute every unauthorized charge. Include small test charges, even if they look like rounding errors.
Stop contact with anyone who reached out about the breach. Don’t send money, codes, or card details to callers or texters, even if they know your name and address.
If you gave a scammer more information, such as your CVV, Social Security number, or bank login, change affected passwords, turn on multi-factor authentication, and consider a free credit freeze with Equifax, Experian, and TransUnion.
If someone used your details to open accounts, report it and get a recovery plan at IdentityTheft.gov.
Keep records. Save statements, dispute confirmations, Revolve’s letter, and any suspicious messages or phone numbers.
How to Report Revolve Breach Fraud and Scams
Your card issuer or bank: for unauthorized charges and replacement cards
FTC: report breach-themed phishing calls, emails, or texts at ReportFraud.ftc.gov
gov: if your information was used to open accounts or commit other identity theft
FBI Internet Crime Complaint Center: if you lost money to a scam that used the Revolve name, at ic3.gov
Revolve’s call center: 888-517-6458, for questions about your notice
The single most effective step for Revolve shoppers who saved a card is to replace that card number now. A new number cuts off the stolen data at the source, no matter how long it circulates.
Revolve Data Breach FAQ
Is Revolve offering free credit monitoring?
No. Revolve is not offering free identity theft or credit monitoring. You can check your credit reports for free at AnnualCreditReport.com.
Should I delete my Revolve account?
You don’t need to delete your account to cut off this breach. Removing saved cards and replacing the exposed card number does that. If you no longer shop at Revolve, you can request account deletion through Revolve’s privacy policy.
Is this the same as the Revolut or Evolve Bank breaches?
No. Revolve Group is a US online fashion retailer. Revolut is a financial app, and Evolve Bank & Trust is a bank, and both had separate incidents.
Hackers stole about $6.36 billion in cryptocurrency from Binance wallets on Oct. 29, 2026, according to blockchain intelligence firm TRM Labs, the largest crypto heist on record. Binance estimates the impact at $6.3 billion and says it will cover all losses from its SAFU fund and company funds. If you hold crypto on any platform, expect scammers to use this news as bait: check your account only in the official app, and never share your seed phrase.
Key Takeaways
TRM Labs puts the theft at about $6.36 billion, drained from Binance wallets on 10 blockchains, mostly within 20 minutes.
Binance says user funds are safe and that it will cover all losses. Binance briefly suspended deposits and withdrawals. Deposits are back to normal, and withdrawals remain paused.
TRM Labs and Chainalysis attribute the attack to TraderTraitor, a North Korean hacking group.
Binance’s early findings point to one engineer’s compromised work laptop, plus additional points of breach still under investigation.
The biggest risk for most people now is follow-on scams: fake support messages, fake refund sites, and fake recovery firms.
What Happened in the Binance Crypto Heist
Attackers moved billions of dollars in crypto out of Binance’s hot wallets, the internet-connected wallets an exchange uses to process withdrawals. According to TRM Labs’ Oct. 29 analysis, most of the roughly $6.36 billion left in about 20 minutes starting at 20:05 UTC (4:05 p.m. ET), across 10 blockchains. That is about four times the $1.5 billion Bybit hack of February 2025, previously the largest on record.
Binance’s own estimate puts the impact at about $6.3 billion. Binance says it and its blockchain partners have frozen about $3 billion in affected assets on-chain, while TRM Labs estimates the attacker still holds about $2.4 billion in assets that issuers can’t freeze.
Is Your Money on Binance Safe?
Binance says yes. Late on Oct. 29, Binance said user funds are safe and that it will cover all losses from its SAFU fund and company funds. SAFU, short for Secure Asset Fund for Users, is an emergency reserve Binance set up to cover losses from incidents like this one.
In an Oct. 30 video update, Binance co-CEO Richard Teng said Binance has reserved more than $6.34 billion of company funds to cover the stolen assets, $5 billion of which is already held in the exact tokens taken, according to Decrypt.
What that means for you as of October 30, 2026:
Deposits and withdrawals: Binance briefly suspended deposits and withdrawals. Deposits are back to normal, and withdrawals remain paused while Binance completes a security revamp of its withdrawal service. In the same video, Teng said Binance aims to reopen withdrawals within about 40 hours, ahead of a Sunday, Nov. 1 deadline, once the rebuilt service passes testing, according to WinBuzzer.
Your balance: Teng said the exchange never uses customer funds, “so they are not impacted,” according to Bitcoin.com News; the losses hit Binance’s corporate holdings. Teng advised anyone concerned to check their balance and contact Binance support. You don’t need to file a claim, pay anyone, or move funds to protect your balance.
US: Binance.US, a separate platform that serves US residents, said it has not been affected, according to the BBC.
Next updates: Binance says it will publish a technical post-mortem when its investigation is complete. Get updates only from Binance’s official app, website, or verified social accounts.
Who’s Behind the Hack and How It Worked
TRM Labs attributes the attack with high confidence to TraderTraitor, which it calls North Korea’s elite hacking unit. Chainalysis reached the same conclusion after watching stolen Binance funds mix with funds from an earlier exploit tied to North Korea. The FBI attributed the 2025 Bybit hack to the same group, which is part of North Korea’s Lazarus Group.
The attack reportedly started on a single device. Binance’s initial investigation suggests it may have begun with a compromised DevOps engineer’s laptop, which gave the attacker access to a service container used to submit withdrawals. Binance has found no evidence that wallet private keys leaked, but it later said it uncovered “additional points of breach” and hasn’t published a root cause.
TRM Labs reports that on Ethereum, the attacker submitted 50 pre-signed authorizations so that one would work, handing control of a Binance hot wallet to a contract only the attacker could command.
The lesson for everyone else: a compromised computer can hand attackers the keys to accounts it touches. The same logic applies at home. If malware lands on the laptop or phone you use for crypto, an attacker can capture passwords, swap wallet addresses you copy, or approve transactions in your name. Learn more in our guide to how data breaches happen and how to avoid them.
Scams That Can Follow the Binance Hack
Scammers often target crypto holders after major exchange incidents. After FTX collapsed in 2022, McAfee Labs found several phishing sites targeting FTX users, including one that asked people to submit their crypto wallet phrase to receive a refund.
“When news about such big breaches breaks, there tends to be panic and confusion for consumers. Scammers will try and take advantage and leverage this incident by making contact over Email, text/whatsapp, a phone call,” says McAfee’s Head of Threat Research Abhishek Karnik. “Avoid such interactions that come out of the blue. The key is don’t panic, don’t react to inbound messages, and don’t have a knee-jerk reaction. Consumers shouldn’t let urgency override verification. If you are curious about your account at Binance, verify it but by navigating to the trusted website and not clicking on a link you received inadvertently from a text or email. The breach may be the headline, but the secondary scam wave could reach far more consumers.”
Watch for these red flags:
Red Flag
Why It Matters
An email, text, or call saying your Binance account is “at risk”
In an Oct. 29 statement to TechCrunch, Binance said it would share verified updates through official channels and warned users to avoid unofficial links.
A request for your seed phrase or private key to “verify” or “refund” you
Anyone with your seed phrase can empty your wallet. This is the exact tactic McAfee Labs found on fake FTX refund sites.
Instructions to move your crypto to a “safe wallet”
The wallet belongs to the scammer. Binance has pledged to cover the losses from its own funds. Moving your crypto won’t protect it.
A compensation form, claims portal, or airdrop for “hack victims”
Binance has not announced any claims process as of October 30, 2026. Fake refund sites can steal your login, seed phrase, or wallet approvals.
An unsolicited law firm or “recovery service” offering to get your crypto back
The FBI’s IC3 warned in August 2025 that fake law firms target people who lost crypto and charge fees.
A claim to work with the FBI or another government agency
“There are no law firms which are officially authorized partners of US Government agencies,” according to the same IC3 warning.
Fees requested in crypto or gift cards, or through a WhatsApp group chat
Fees demanded in crypto or gift cards, or talks moved to a private group chat, are common signs of a recovery scam.
“Support agents” who contact you first on social media or messaging apps
Real support is reached through the exchange’s official app or website, not through accounts that message you.
The most important step is to verify every message about your account through the official app, never through a link. These steps apply whether you use Binance, another exchange, or your own wallet:
Check your account only in the official app or by typing the web address yourself. Scam messages copy real branding and link to look-alike sites. Bookmark the real site and use only that.
Never share your seed phrase or private keys. No legitimate exchange, wallet, or recovery service needs them. Treat any request for them as a scam.
Use an authenticator app, passkey, or hardware security key for two-factor authentication. These are harder to intercept than codes sent by text message.
Turn on your exchange’s extra protections. If your exchange offers a withdrawal address allowlist or an anti-phishing code in its emails, turn them on. They make unauthorized withdrawals and fake emails easier to catch.
Review and revoke wallet permissions you don’t recognize. Connecting a wallet to a site can grant it ongoing permission to move certain tokens. Use your wallet’s settings or a block explorer’s approval checker to remove ones you no longer use.
Keep the devices you use for crypto updated and clean. The Binance hack reportedly began on one laptop. Install system and browser updates promptly, avoid unknown apps and browser extensions, and consider a dedicated device for large holdings.
Double-check every address before you send. Some malware swaps a copied wallet address for the attacker’s. Compare the first and last several characters before confirming.
Don’t act on urgency. Pressure to move funds, pay a fee, or confirm details “within the hour” is a sign of a scam. You don’t need to pay anyone or move funds to protect your Binance balance.
Exchange vs. Self-Custody: What’s the Difference?
Neither option removes all risk; they trade one set of risks for another. Here’s how they compare:
Lost or stolen seed phrase, malware, signing a malicious transaction
If something goes wrong
Depends on the exchange’s reserves and policies
Usually no one can reverse the loss
What protects you most
Strong two-factor authentication and phishing awareness
Offline seed phrase backup and careful transaction review
Whichever you choose, the same rule applies: nobody legitimate will ask for your seed phrase. For more background, see our guide to blockchain security. This article doesn’t recommend specific wallets, exchanges, or investments.
What to Do If You’ve Already Been Targeted
If you clicked a suspicious link, shared account details, or sent crypto after this hack, act quickly to limit the damage. Scammers are skilled at timing their messages to major news, and anyone can be caught off guard.
Stop all contact. Don’t reply, and don’t send more money or crypto, even if the person promises a refund or says one more fee will unlock your funds.
Secure your accounts. Change your exchange and email passwords from a device you trust, and turn on app-based two-factor authentication. Sign out of all other sessions if your exchange allows it.
If you shared your seed phrase, move what’s left. Create a new wallet with a new seed phrase on a clean device, and transfer any remaining funds there. The old wallet is no longer safe.
Revoke wallet permissions. If you connected your wallet to a suspicious site, revoke the approvals it received.
Contact the platform you sent from. Report the transaction to your exchange or wallet provider through its official support channel. Exchanges can sometimes flag or freeze funds that reach another platform.
Check your devices. Update your operating system and remove apps or browser extensions you don’t recognize. If you installed something a scammer sent, run a full security scan.
Protect your identity if you shared personal details. If you gave out your Social Security number, ID photos, or bank details, go to IdentityTheft.gov and consider a free credit freeze with Equifax, Experian, and TransUnion.
Keep records. Save wallet addresses, transaction IDs (hashes), dates, amounts, screenshots, phone numbers, and messages. Investigators and platforms need them.
If you’re a Binance customer and haven’t interacted with a scammer, you don’t need to pay anyone or move funds. If you’re concerned, check your balance and contact Binance support through its official app. Don’t pay anyone who offers to file a claim for you.
How to Report It
Report scams and suspicious messages tied to the Binance hack to these channels:
FBI Internet Crime Complaint Center: file at ic3.gov, and include wallet addresses and transaction IDs.
Binance: report phishing and fake accounts through Binance’s official app or website support.
Your local FBI field office or police: contact them if you lost money or were threatened. The IC3 recommends contacting a local FBI field office about fake law firms.
The Binance hack is the largest crypto theft on record, but for most people, the next risk arrives by email, text, or direct message. Check your account only through the official app, never share your seed phrase, and treat any unsolicited offer to recover or protect your crypto as a scam.
FAQ
Can stolen crypto be recovered?
Sometimes, but only in part. Some tokens can be frozen: about $2.7 billion of the Binance theft has been frozen, mostly by stablecoin issuers, according to TRM Labs. Recovery isn’t guaranteed: TRM Labs estimates the attacker still holds about $2.4 billion beyond issuers’ reach. Be wary of anyone who contacts you offering to recover crypto for a fee, the FBI’s IC3 warns.
Can someone steal my crypto if they have my wallet address?
Not with the address alone. A wallet address lets people see your balance and send you funds. To move your crypto, a thief needs your private key or seed phrase, or needs you to approve a malicious transaction.
Can you lose crypto in a cold wallet?
Yes. A cold wallet keeps your keys offline, which reduces exposure to online hacks. You can still lose funds if someone gets your seed phrase, you lose your only backup, or you approve a malicious transaction.
Quest Diagnostics, one of the largest lab testing companies in the US, disclosed in an October 22, 2026, SEC filing that an unauthorized party accessed certain patient records in its Quanum Lab Services Manager (LSM) system. The company’s Quanum security notice says Quest believes protected health information and personal information were involved. The number of affected patients and the specific data taken have not been disclosed, and the investigation is ongoing.
How the Quest Diagnostics Breach Happened and What Was Exposed
The unauthorized access was discovered on October 21, 2026, according to Quest’s SEC filing. Doctors’ offices, health systems, and other Quest clients use Quanum LSM to place lab test orders and to receive and look up results. Patient data inside that system was accessed, the company says, but its other systems were not affected.
According to the notice, the company believes both protected health information (PHI) and personally identifiable information (PII) were involved. Quest has not listed which specific data fields were exposed, and it has not disclosed how many patients were affected. The potential reach is wide: Quest says it serves about half of the physicians and hospitals in the US and touches the lives of one in three American adults each year.
To contain the breach, Quest paused access to Quanum LSM and, as a precaution, to its Essential Insights and LabHQ systems. Its notice says access to all three had been restored as of October 26. The SEC filing adds that Quest notified federal law enforcement and brought in outside cybersecurity experts. As of October 23, no hacking group had publicly claimed the attack. Quest is posting updates on its security notice at questdiagnostics.com/links/quanum-notice.
This is not Quest’s first breach involving patient data. In 2019, about 11.9 million Quest patients were affected by a breach at AMCA, a third-party billing collections vendor. Medical records exposed in older breaches can still be misused today. Health data retains its value to criminals over time, because unlike a credit card number, it cannot be canceled or reissued.
Red Flags: Scams That Follow the Quest Breach
The most immediate risk for most patients is follow-up scams that use the breach as a hook. Quest’s own notice warns people to watch for “breach-notification, credit-monitoring or settlement scams.”
Red Flag
Why It Matters
An email, text, or call about the Quest breach asking you to confirm your Social Security number, insurance ID, or date of birth
Quest has said it will notify affected patients by letter. A message asking you to re-enter personal data is a common way to collect more of it.
A credit or identity monitoring offer that asks for payment or sends you to an unfamiliar link
Quest says its notification letters will describe available resources, including credit and identity monitoring. Verify any offer through Quest’s official website or phone number.
A “class action settlement” message asking for a fee or your bank details
Quest’s notice specifically flags settlement scams. Treat any request to pay to join a settlement as fraud.
A “your lab results are ready” message with a login link you didn’t expect
Scammers borrow the look of real health notices. Log in only through an app or website you already use.
A bill or Explanation of Benefits (EOB) for lab tests or services you didn’t get
Charges for care you never received can mean someone is using your medical identity.
A debt collector contacting you about medical debt you don’t owe
Collection notices for unfamiliar medical debt can mean someone received care or opened accounts in your name.
How to Protect Yourself After the Quest Diagnostics Breach
If you’ve had lab work processed by Quest, take these steps now, even if you don’t yet know whether your records were involved.
Get updates from Quest directly. Use the official notice at questdiagnostics.com/links/quanum-notice or call Quest at 1-866-MYQUEST. If someone contacts you first about the breach via call, text, or email, don’t use any phone number or click any link they provide. Contact Quest through these official channels instead.
Watch your mail for a notification letter. Quest says it will send letters to affected patients once its investigation identifies them. If a letter includes a monitoring enrollment code, confirm it by contacting Quest through its official channels before you enroll.
Review your medical bills and EOBs. Look for tests, visits, or prescriptions you don’t recognize. This is one of the earliest places medical identity theft shows up.
Check your credit reports. You can get free reports from Equifax, Experian, and TransUnion at AnnualCreditReport.com. Look for accounts or medical collections you don’t recognize.
Consider a credit freeze. A freeze is free and blocks new credit accounts from being opened in your name. You can lift it temporarily when you need to apply for credit.
Secure your health accounts. Use a unique password for any patient portal or health app, and turn on multi-factor authentication where it’s available. A password manager makes it easier to keep up with unique passwords.
Be skeptical of unexpected breach messages. Quest has said it will notify affected patients by letter. If an email, text, or call asks you to act quickly, click a link, or share personal or payment details, don’t respond. Contact Quest directly using the number on its official website.
What to Do If Your Information Was Exposed or You’ve Already Been Targeted
Your next steps depend on what has happened so far:
If you received a Quest notification letter: Follow its instructions, note any enrollment deadline, and keep the letter with your records.
If you shared information with a scammer: Stop contact. Call your bank, card issuer, or payment app right away to try to stop or reverse any payments.
If you gave away a password: Change it on that account and any account that uses the same password, and turn on multi-factor authentication.
If you see signs of medical identity theft: The FTC recommends asking each doctor, lab, pharmacy, and insurer involved for copies of your records and reporting any errors in writing. If a provider doesn’t send your records within 30 days of a written request, you can file a complaint with the HHS Office for Civil Rights.
If fraudulent claims appear: Call your health insurer’s fraud line, using the number on your insurance card.
If your identity data was exposed or misused: Place a credit freeze or fraud alert with Equifax, Experian, and TransUnion, and create a recovery plan at IdentityTheft.gov.
Keep records: Save the breach letter, suspicious messages, phone numbers, bills, EOBs, and notes from every call.
How to Report It
Report breach-related fraud and identity theft to the right channel:
Online fraud that cost you money: FBI Internet Crime Complaint Center at ic3.gov
Concerns about how your health information was handled: HHS Office for Civil Rights at hhs.gov/ocr/complaints
Money lost or threats made: Your local police department
Quest is still determining whose records were accessed, so the most useful step today is to treat every unexpected message about this breach as suspect. Get information only from Quest’s official notice or phone number, and check your bills, EOBs, and credit reports for activity you don’t recognize.
FAQ
Was my information exposed in the Quest Diagnostics breach?
Quest has not disclosed how many patients were affected. It says it will send notification letters to affected patients once its investigation identifies them.
What is Quanum Lab Services Manager?
Quanum LSM is a Quest system that healthcare providers use to place lab test orders and to receive and look up results. Quest describes it as a system its clients use, so patients’ records can be in it when their provider orders tests through it.
Will Quest offer free credit monitoring?
Quest’s notice says its letters will describe available resources, including credit and identity monitoring. Enrollment details have not been published, so verify any offer through Quest’s official channels.
Is this related to the 2019 Quest data breach?
No. The 2019 breach happened at AMCA, a third-party billing collections vendor. The 2026 incident involves Quest’s own Quanum LSM system.
Capcom, the Japanese publisher behind Street Fighter, Resident Evil, and Monster Hunter, confirmed on October 22, 2026, that an unauthorized third party accessed records tied to more than 11.7 million CAPCOM ID accounts worldwide. According to the company’s official notice, the exposed data includes email addresses and account details such as creation dates, login counts, and the IP address used at last login. Capcom says credit card information was not affected, and it is warning players about fraudulent messages that impersonate the company.
How the CAPCOM ID Breach Happened and What Was Exposed
Unauthorized access to CAPCOM ID, a free player account for games such as Street Fighter 6, was detected on October 19, 2026, and blocked on the same day. The company reported the incident to police and Japan’s Personal Information Protection Commission on October 21.
Most of the 11.7 million records held only an email address and basic account activity: creation date, last login, login count, and last-login IP address. Forty-three records also included a date of birth, gender, country or region, and nickname. The attacker also changed passwords on 196 accounts, which Capcom has since reset, and used 19 of them to view e-Capcom store profiles in Japan with names, addresses, phone numbers, birth dates, and purchase histories, according to an October 23 update.
Capcom says credit card information was not affected and it has not confirmed that customer-set passwords were compromised. Its investigation is complete, and it will notify affected customers.
Why Phishing Is the Bigger Risk
Capcom warns that the exposed data could be used in emails, texts, or calls impersonating the company. A message that quotes your real email address, account creation date, or last login can look convincing because those details are accurate. Scammers use that credibility to steer players to fake login pages or to request passwords, one-time codes, or payment details, which they can use to take over accounts or commit fraud.
Gamers are a regular target. Every major game launch brings a noticeable increase in gaming-themed scams, including phishing pages posing as gaming platforms, according to McAfee’s August 2026 report on gaming scams. McAfee Labs also recently reported on WeedHack, malware disguised as free Minecraft clients and mods, that has infected more than 116,000 gamers.
Warning Signs of CAPCOM ID Phishing
Watch for messages that use the breach as a hook. Common red flags include:
Red Flag
Why It Matters
An unexpected email or text about your CAPCOM ID, a password reset, or account suspension
The breach gives scammers a believable reason to contact you.
Your real account details used as “proof”
Creation dates, login counts, and IP addresses were exposed, so knowing them does not prove a message is from Capcom.
A link or attachment urging you to “verify” or “secure” your account, especially from a look-alike domain
Capcom advises customers not to open links or attachments in suspicious messages.
A request for your password, a one-time code, or payment card details
Attackers use these to take over accounts or commit fraud.
Offers of free in-game currency, DLC, or compensation for the breach
Freebies tied to a breach are a common lure to fake login pages.
An unsolicited call claiming to be Capcom support
Calls are harder to verify, and some phone numbers were exposed.
How to Protect Your CAPCOM ID and Gaming Accounts
Treat any breach-related message as suspicious until you verify it yourself, then lock down the accounts attackers would target first:
Verify through Capcom directly. Don’t use links in messages. Type the CAPCOM ID site address into your browser, and use only the support contacts Capcom lists in its notice, such as the Capcom customer support site. If you can’t confirm a request there, don’t act on it.
Change your CAPCOM ID password and any reused passwords. Capcom has not confirmed that customer-set passwords were exposed, but a new, unique password limits the damage if account details are misused. A password manager makes maintaining many unique passwords practical.
Secure your email and turn on multi-factor authentication. Your email controls password resets, so protect it first. Then add multi-factor authentication to your PlayStation, Xbox, Nintendo, and Steam accounts so a stolen password alone isn’t enough to sign in.
What to Do If You’ve Already Been Targeted
If you clicked a link, entered your login, or shared information with someone posing as Capcom, act now to limit the damage:
Stop responding to the sender and don’t send any money, codes, or card details.
Reset your passwords now, starting with your email, then your CAPCOM ID and any account that shares that password. Check your email’s recovery phone number and forwarding rules for changes.
Call your bank or card issuer right away if you entered payment details, and ask about stopping or reversing charges.
Review your accounts for unfamiliar purchases, linked devices, or changed settings on your game platforms.
Consider acredit freeze with Equifax, Experian, and TransUnion if you shared your name, address, date of birth, or other identity details.
Visitidentitytheft.gov for a personalized recovery plan if your personal information was misused.
Keep records of suspicious messages, sender addresses, phone numbers, links, and any receipts.
How to Report CAPCOM ID Phishing
Reporting helps platforms and investigators shut down phishing campaigns. In the U.S.:
Your email provider: Use the “report phishing” or “report spam” option so similar messages get filtered.
Local police: File a report if you lost money or were threatened.
The CAPCOM ID breach exposed contact and account details, not credit card data, so the main threat now is phishing that looks like it comes from Capcom. Don’t click links in unexpected Capcom messages. Only sign in through the official site or your game, and use a unique password with multi-factor authentication on your email and gaming accounts.
FAQ
Was my credit card information exposed in the Capcom breach?
Capcom says credit card information was not included in the affected data. That applies to both the CAPCOM ID records and the 19 e-Capcom store accounts accessed in Japan.
Were CAPCOM ID passwords stolen?
Capcom says it has not confirmed that passwords customers set themselves were compromised. However, the attacker changed the passwords of 196 accounts, which Capcom has since reset. That said, it is still a good idea to update your password, use multi-factor authorization, and avoid using the same password for multiple accounts.
How do I know if my CAPCOM ID was affected?
Capcom says it will notify affected customers. Because 11.7 million records were involved, assume your email may be on the list if you have a CAPCOM ID, and watch for phishing.
Can I still play Street Fighter 6 and other Capcom games?
Yes. Capcom says access to games and CAPCOM ID–linked services was not affected, and registered email addresses can still be used.
Hackers stole about 8.3 million confidential tip records submitted to school safety and crime tip lines across the US and Canada, according to Nevada education officials citing media estimates. The exposed data may include names, addresses, dates of birth, and Social Security numbers. The tips were stored on P3 Global Intel, an anonymous reporting platform owned by safety software company Navigate360, which acknowledged the breach on Oct. 23, 2026, as reported by Reuters.
How the Navigate360 Breach Happened
An attacker accessed Navigate360’s P3 Global Intel system between November 2025 and March 2026 and copied confidential tips. P3 runs the anonymous reporting apps and websites behind many school safety and crime tip lines. According to an April 2026 letter from U.S. Sens. Maggie Hassan and Jim Banks, Navigate360’s products are used by more than 35,000 schools and 5,000 public safety agencies.
Here is what’s known so far:
March 2026: A hacktivist group claimed it stole 93GB of data, including millions of tips.
22, 2026: The Nevada Department of Education said about 10% of SafeVoice Nevada tips containing personally identifiable information were compromised between November 2025 and March 2026, in what it called a “criminal multistate cybersecurity incident.”
22, 2026: Toronto Crime Stoppers said it had frozen its operations after CBC reported that more than 1.5 million Canadian Crime Stoppers tips, some dating back 25 years, were exposed. The stolen data had been made available to journalists and researchers by the transparency group Distributed Denial of Secrets in March, according to The Record.
23, 2026: Navigate360 publicly acknowledged the breach and said sensitive personal data may have been exposed.
Tip records are different from most breached data. A single tip can include the tipster’s details, a student’s name, a description of another person, and sensitive details such as medical information. Nevada says it cannot notify everyone directly because SafeVoice tips are anonymous, so many affected people may never receive a letter.
Exposed personal data often fuels follow-up scams. Americans already receive an average of 14 scam messages a day across text, email, and social media, according to McAfee’s State of the Scamiverse report (January 2026). Breach news gives scammers a fresh, believable pretext to add to that volume.
Red Flags After the Navigate360 Breach
Watch for messages that use this breach as a hook:
A text or email about “your tip” or “your SafeVoice report” with a link: Scammers copy breach news to steer people to fake claim or login pages.
A caller who says they’re from Navigate360, a school, or police and asks for your SSN or bank details: Legitimate breach notifications don’t ask for payment, and you should never give your full SSN to an unsolicited caller.
A demand for payment to “remove” your tip or keep it private: No legitimate organization charges to protect leaked data. This is extortion or a scam.
Someone who knows details from a tip you submitted: This may mean your tip was exposed. Treat it as a possible safety issue, not just a scam.
New credit accounts, inquiries, or tax notices you don’t recognize: These are signs your SSN may be in use.
Mail or calls about credit in your child’s name: Children rarely have credit, so this activity is a warning sign.
How to Protect Yourself After the Navigate360 Breach
If you or your child ever submitted a tip through SafeVoice, a Crime Stoppers program, or another P3-powered tip line, take these steps now:
Use only the official notice line. Navigate360’s call center is 833-966-1754, open 6 a.m. to 6 p.m. Pacific Time, Monday through Friday, according to the Nevada Department of Education. If a message gives a different number or link, don’t use it.
Freeze your credit. A freeze with Equifax, Experian, and TransUnion blocks new accounts in your name. It’s free and does not affect your current accounts.
Freeze your child’s credit, too. Parents and legal guardians can freeze credit files for children under 16 at no cost. You’ll typically need your child’s birth certificate and Social Security card, your ID, and proof of address. Our guide on how to protect your child from identity theft walks through the freeze and other steps.
Check your credit reports. Get free reports at AnnualCreditReport.com and look for accounts or inquiries you don’t recognize.
Treat unexpected breach messages as suspect. Don’t click links or call numbers in unsolicited texts or emails. Go directly to the official source instead.
Turn on multi-factor authentication. Add it to email, banking, and school accounts so a stolen password alone can’t unlock them.
What to Do If Your Information Was Exposed or Misused
Act quickly if you see signs your data is being used:
Report identity theft: Go to identitytheft.gov to get a recovery plan and an FTC Identity Theft Report.
Contact your bank or card issuer: Call right away if you see charges or accounts you didn’t open.
Stop contact and don’t send money: Don’t pay anyone who threatens to release your tip or demands payment.
Change passwords: Update any account that shares a password you used with a tip app or school portal.
Call the Navigate360 line: Dial 833-966-1754 to ask about the breach and available help.
Keep records: Save letters, messages, phone numbers, and any accounts or charges you dispute.
Contact police: File a report if anyone threatens or harasses you over a tip.
How to Report Navigate360 Breach Scams and Identity Theft
If you encounter suspicious activity, potential scam communications, or identity theft related to the breach, it is essential to report it promptly to the appropriate authorities. Reporting assists law enforcement in tracking fraudulent schemes and protects others from falling victim. Use these official channels:
Online fraud or extortion: FBI Internet Crime Complaint Center at ic3.gov
Threats to your safety: Your local police department
While learning about a potential breach can be unsettling, taking a few proactive steps can go a long way in securing your personal information. If you or your child have ever used SafeVoice, Crime Stoppers, or another P3-powered tip service, freezing your credit files is an effective measure to help keep your family protected. As always, stay vigilant and verify any unexpected messages referencing your tip through official channels.
FAQ
Is SafeVoice Nevada still safe to use?
Navigate360 told Nevada that SafeVoice “remains fully operational and available 24/7.” The state has also opened a request for information to evaluate other vendors, according to the Nevada Department of Education.
What information was exposed in the Navigate360 breach?
Navigate360 said names, addresses, dates of birth, Social Security numbers, and other sensitive information may have been exposed. What was exposed varies by tip.
Which states were affected by the Navigate360 breach?
As of Oct. 27, 2026, Nevada is the only US state that has publicly quantified its impact. Canadian Crime Stoppers programs were also affected. Navigate360 has not published a full list.
Financial scammers are increasingly targeting older Americans, using deceptive online platforms, high-pressure phone pitches, and complex impersonation schemes to drain hard-earned savings. While older consumers are more likely to report suspicious solicitations, those who get caught in these elaborate operations face catastrophic financial consequences. As digital payment systems and online networks evolve, organized criminal rings are extracting record amounts of capital from people preparing for or living in retirement.
On October 19, 2026, the Federal Trade Commission (FTC) submitted its annual report to Congress, Protecting Older Consumers 2025–2026, detailing the rapid escalation of this trend. The report revealed that fraud losses reported by adults aged 60 and older reached approximately $3 billion in 2025, a fivefold increase from the $600 million reported in 2020. Since most victims do not report fraud to government agencies, the FTC estimates actual losses for older adults in 2025 ranged between $13.3 billion and $119.5 billion.
How Fraud Schemes Target Older Adults
The sharp rise in elder fraud is largely propelled by a surge in massive, individual six-figure losses. Combined losses from older adults who lost $100,000 or more increased nearly sevenfold between 2020 and 2025. While these severe losses represented only 6% of loss reports filed by older adults in 2025, they accounted for 70% of the entire $3 billion total.
Analysis of consumer reports reveals that these catastrophic losses were concentrated in these specific scam categories:
Investment Scams Promoted on Social Media
Investment fraud was the costliest category for older consumers in 2025, with $1.06 billion in reported losses, a 42% jump. Scammers use social media to pitch fake crypto, stock, or automated trading platforms, directing targets to fraudulent sites displaying falsified account balances. When victims request withdrawals, operators demand bogus “taxes” or “administrative fees” before freezing accounts.
Government and Business Impersonation Schemes
Government and business impersonators drew $870 million in losses ($448M government, $422M business). Government imposters claim bank accounts are tied to crime, while business imposters pose as bank or tech support fraud departments. Both fabricate urgent crises, coercing victims to transfer money to “protective custodial accounts” or government “lockboxes.”
Romance Scams That Exploit Trust
Romance scams caused $384 million in reported losses among older adults in 2025 (up 17%). Fraudsters build trust over weeks or months via social media or dating apps before fabricating urgent emergencies—like medical bills or foreign travel issues—to request repeated money transfers.
Prize, Sweepstakes, and Lottery Schemes
Prize and lottery scams cost older adults $143 million in 2025. Scammers contact targets via phone, mail, or online, claiming major prize wins from known brands but requiring upfront processing fees or taxes to release funds.
Tech Support Deception
Older consumers were over four times (324%) more likely than younger adults to report losing money to tech support scams. Alarming browser pop-ups prompt calls to fake technicians who gain remote access to computers and charge high fees for unneeded services.
Irreversible Payment Methods That Fuel the Losses
While credit cards were the payment method most frequently used by older adults (accounting for 28% of loss reports), payment channels that cannot be easily recalled accounted for the largest aggregate dollar amounts. Bank transfers and payments accounted for over $1.03 billion in reported losses, while cryptocurrency transfers totaled $603 million. In impersonation and sweepstakes scams, criminals also routinely demand payment through retail gift cards, direct bank wires, physical cash sent via couriers, or cash deposits into automated Bitcoin kiosks.
The table below details the top six fraud categories ranked by total reported dollars lost by older adults (ages 60 and older) in 2025, alongside the year-over-year percentage change compared to calendar year 2024.
Fraud Category
2025 Reported Losses (Age 60+)
Change from 2024
2025 Loss Reports
Common Tactic
Investment Scams
$1.059 billion
+42%
10,578
Counterfeit crypto dashboards and fake trading platforms.
Government Imposters
$448 million
+20%
12,183
Threats of arrest or asset seizure to force money transfers.
Business Imposters
$422 million
+12%
24,820
Fake bank fraud alerts directing funds to “safe” accounts.
Romance Scams
$384 million
+17%
6,832
Fabricated emergencies or joint investment pitches from online partners.
Prizes, Sweepstakes & Lotteries
$143 million
-1%
5,280
Upfront fee demands to release fake winnings.
Tech Support Scams
$126 million
-21%
5,334
Browser pop-ups prompting calls to bogus technicians.
Warning Signs of Elder Scams
Federal agencies participating in the nationwide Never Ever campaign, led by the FTC, the Department of Justice (DOJ), and the Department of Health and Human Services (HHS), have identified clear warning signs that expose fraudulent communications.
Demands to transfer money to “protect” it: Legitimate banks and government agencies never tell you to move your funds into a separate account, a crypto kiosk, or a temporary vault to keep it safe from fraud.
Insistence on specific, unusual payment methods: Demands to pay using retail gift cards, cryptocurrency, money-transfer apps, bank wires, or envelopes of cash collected by a courier are red flags that you may be dealing with a scam.
Demands for complete secrecy: Fraudsters often order you to stay on the line, instruct you not to speak with family members, and supply fake cover stories to recite to bank tellers during cash withdrawals.
How to Protect Yourself and Older Relatives
You do not need to be a technical expert to guard against these schemes. Following five straightforward habits can help protect household savings from scams:
Hang up and call a number you know is real. If you get a call or text claiming your bank account, credit card, or Social Security number is in danger, hang up immediately. Do not press any buttons or call back the number that contacted you. Pick up your physical debit card, credit card, or an official paper statement, and call the customer service phone number printed on the back.
Talk to a family member or friend before you pay. Scammers rely on panic to make you act before you have time to think. Make it a personal rule to discuss any unexpected financial request, sudden investment tip, or prize notification with a trusted relative, neighbor, or bank employee before you authorize any transfer.
Refuse all requests to buy gift cards or use Bitcoin machines. If anyone on the phone tells you to go to a retail store to buy gift cards, or asks you to deposit cash into a Bitcoin ATM to clear a bill or protect your savings, stop. Legitimate businesses and government offices do not accept payment through these methods.
Restart your computer if an alarming warning screen appears. If your screen suddenly freezes with loud alarms or an urgent warning saying you are hacked, never call the phone number shown. Press and hold your computer’s power button until everything turns completely off, wait 30 seconds, and turn it back on. When you reopen your internet browser, click “Cancel” or the “X” if it asks to restore your previous pages.
Let unfamiliar phone calls go to voicemail. Scammers can alter the name and phone number that appear on your phone screen to look like a local courthouse, police department, or bank. Let calls from numbers you do not recognize go to voicemail. If a matter is truly legitimate, the organization will leave a message and send official mail.
What to Do If You Have Already Been Targeted
When money has been sent or sensitive personal details have been disclosed, acting promptly improves the chances of limiting damage and recovering funds:
Cut off all communication: Discontinue every phone call, text exchange, and email thread with the scammer. Never send additional money to “release” previously transferred funds or pay supposed “withdrawal fees.”
Contact your financial institutions immediately: Call your bank, credit union, or credit card company. Request an immediate recall on any recent wire transfers, flag fraudulent debit or credit charges, and ask the bank to secure your accounts.
Request the Financial Fraud Kill Chain for wire transfers: If you sent a significant bank wire within the last 72 hours, submit a report immediately to the FBI Internet Crime Complaint Center. The FBI’s Recovery Asset Team works directly with domestic and international financial networks to freeze fraudulent wire transfers before they settle. In 2025, this process helped freeze $679 million in stolen funds.
Contact the National Elder Fraud Hotline: Call the DOJ’s free hotline at 1-833-372-8311. Staffed by the Office for Victims of Crime, case managers provide direct support, help you organize reporting documentation, and connect you with local and federal resources.
Place a security freeze on your credit reports: Restrict identity thieves from opening new lines of credit by freezing your credit files directly with the three national credit bureaus: Equifax, Experian, and TransUnion.
Report identity exposure: If you provided your Social Security number, banking details, or driver’s license number, go to IdentityTheft.gov to receive a customized recovery plan.
Preserve all records: Save written notes, phone numbers, text messages, emails, bank transfer confirmations, and cryptocurrency wallet transaction receipts to share with investigators.
How to Report Elder Fraud
Reporting scam attempts provides law enforcement agencies with the evidence required to identify criminal syndicates, freeze illicit assets, and bring enforcement actions. In fiscal year 2026, FTC enforcement actions resulted in more than $513 million returned to consumers of all ages.
Submit incident details through these official reporting portals:
Federal Trade Commission: Submit reports through the FTC Fraud Reporting Portal, which feeds directly into the secure Consumer Sentinel Network used by thousands of law enforcement agencies nationwide.
FBI Internet Crime Complaint Center: Report internet fraud, cryptocurrency theft, and wire transfers to the FBI Internet Crime Complaint Center.
Federal Communications Commission: Report phone number spoofing and unlawful automated calls to the FCC Consumer Complaint Center.
Local Police or Sheriff’s Department: File a formal police report with your local law enforcement agency. Banks frequently require a copy of an official police report to process fraud disputes.
Federal enforcement actions continue to target the infrastructure that enables these operations. In fiscal year 2026, the FTC secured a settlement requiring payment processor Nuvei to turn over $4.85 million for processing transactions for an overseas tech-support scheme that impersonated major US brands. The FTC also took action against operations like American Tax Service, requiring defendants to surrender nearly $10 million in cash and assets for running deceptive tax-debt telemarketing targeting older adults. Staying informed, hanging up on unsolicited calls, and checking in with loved ones remain the most dependable defenses against these escalating threats.
Gen Z grew up online. But that isn’t giving them an advantage against the next generation of AI-powered scams, and the data shows it.
More than one in three Gen Z adults reported losing money to an online scam in the past year. They’re also encountering several types of online fakes at higher rates than Americans overall, including fake social media profiles, fake recruiters, AI-generated images and deepfake-style videos.
The data points to a new reality for a generation that has spent much of its life online: Digital familiarity alone may not be enough when AI is making fake content easier to create and harder to recognize.
Here’s what we found, plus our Head of Threat Research Abhishek Karnik’s key safety takeaways for Gen Z:
5 Online Fakes Fooling Gen Z More Often
1. Fake social media profiles: 51% of Gen Z vs. 41% of Americans overall
More than half of Gen Z adults encountered a fake social media profile in the past year, according to McAfee’s research.
In these instances, someone might impersonate a creator, brand, potential romantic partner or even a person you already know. Once contact is established, the conversation can move toward a suspicious link, request for money, investment opportunity or attempt to collect personal information.
Abhishek’s key takeaway: “Treat unexpected messages regarding requests for money or help, with some level of skepticism, even if it’s from familiar-looking accounts. Account takeovers (where a known contact’s account was compromised) and copycat accounts (impersonated accounts where someone created a similar looking profile) are often tactics used to target victims. Call your friend on a trusted number and confirm if they really need help.”
2. AI-generated images presented as real: 51% vs. 44%
AI image tools can produce realistic-looking people, products, places and events that never existed.
For scammers, that creates another way to manufacture credibility. A fake profile can have convincing photos. A fraudulent product listing can appear to show a real item. An investment or giveaway scam can be dressed up with imagery that looks legitimate at first glance.
Abhishek’s key takeaway: “Look for oddities in the images itself. AI is not always perfect and does make errors. But also look beyond the image. Check the account posting it, the surrounding context and whether reputable sources confirm the claim before acting on it.”
3. Deepfake-style videos: 40% vs. 34%
Two in five Gen Z adults said they encountered deepfake-style videos in the past year.
A deepfake is manipulated or AI-generated media designed to make it appear that a real person said or did something they didn’t. Improvements in AI mean visual oddities alone are becoming a less reliable way to identify one.
Abhishek’s key takeaway: “Not all deepfakes are bad. Some are made for entertainment. However, pause to analyze and consider what the video is asking you to do or believe.
A surprising celebrity investment pitch, urgent request for money or unbelievable announcement deserves independent verification, even when the person on screen looks and sounds convincing.”
4. Fake recruiters and job opportunities: 34% vs. 27%
For Gen Z adults entering or moving through the workforce, job hunting increasingly means interacting with people they have never met through email, social media, job platforms and messaging apps.
Scammers can exploit that normal behavior by posing as recruiters or employers. A convincing company name, professional-looking profile and friendly interview process can make a fraudulent opportunity harder to distinguish from the real thing.
Abhishek’s key takeaway: “Be cautious when a recruiter quickly asks for sensitive personal information, asks you to pay upfront costs or moves the hiring process onto an unusual platform like WhatsApp. Verify the role through the employer’s official website and independently confirm that the recruiter works there.”
5. Fake celebrity endorsements: 27% vs. 21%
AI has also made it easier to put familiar faces and voices behind claims they never made.
Fake celebrity endorsements can appear in investment scams, product promotions and giveaways. What makes them powerful is the borrowed trust. Seeing someone familiar can make an unfamiliar offer feel more credible.
Before buying, investing or sharing information, verify the endorsement through the celebrity’s official channels and independently research the company or offer.
3 Scams Hitting Gen Z’s Wallet Harder
Exposure tells us what people are seeing. Financial loss tells another part of the story.
McAfee’s research found Gen Z adults were more likely than Americans overall to report losing money to three particular types of scams:
Package delivery scams: 25% of Gen Z vs. 18% overall
Fake customer support scams: 24% vs. 18%
AI-generated impersonation scams: 20% vs. 15%
Each takes advantage of an ordinary digital interaction.
Abhishek’s key takeaway: “Scams can work by fitting naturally into what someone is already doing online, making verification increasingly important before clicking a link, sending money or sharing sensitive information.”
3 Ways Job Scams Are Shaking Gen Z’s Confidence
The job market provides one of the clearest examples of how scam concerns can affect people even when they never lose money.
McAfee found:
65% of Gen Z adults say scam concerns have made them hesitate or avoid applying for a job online, compared with 54% of Americans overall.
57% have suspected a recruiter or job opportunity was fake, compared with 43% overall.
39% encountered a fake recruiter or job scam in the past year, compared with 31% overall.
For young adults building careers, that uncertainty can carry a real cost. A legitimate recruiter and a scammer may contact someone through the same platforms and use many of the same professional conventions.
Abhishek’s key takeaway: “Verification can help. Search for the position on the company’s official careers page, check the recruiter independently and contact the company through information you find yourself when something feels questionable.”
The Broader Scam Reality Across the U.S.
Gen Z’s experience sits inside a much bigger shift in how Americans navigate life online.
McAfee’s newest research, which combines a nationally representative survey of 5,000 U.S. adults with McAfee Labs analysis of text-based scam activity, found that 88% of Americans encountered at least one type of scam in the past year. Nearly one-third, 31%, reported losing money to one.
The effects extend beyond financial losses.
Nearly three-quarters of Americans, 74%, say they feel the need to double-check most things online before trusting them. Sixty-two percent say figuring out what is real takes more mental energy than it did a year ago. And 82% say concerns about scams have changed something they do online.
That can mean avoiding an unfamiliar retailer, ignoring a legitimate message or deciding against clicking a real link.
AI adds another layer to that uncertainty because convincing content can now be produced faster and at greater scale. As synthetic content becomes part of everyday digital life, spotting scams cannot depend entirely on whether something simply “looks fake.”
For Gen Z, the findings suggest that challenge is already especially visible. They are encountering some forms of manipulated and fraudulent content more frequently while also navigating important parts of early adult life, from finding work to shopping and managing money, online.
Safety Tips From McAfee Experts
A few habits can help reduce the risk without requiring you to investigate everything you encounter online.
Here’s what our threat researchers want you to know:
Verify through a second channel. If a friend, recruiter, company or customer support representative contacts you unexpectedly, confirm the request somewhere else. Open the company’s official app, visit its website yourself or contact the person using a number you already trust.
Slow down when someone creates urgency. Scammers frequently want a decision before you have time to investigate. Unexpected requests involving money, account credentials, verification codes or personal information deserve an extra check.
Investigate the source, not just the content. AI-generated images, video and audio are becoming increasingly convincing. Check who posted something, where an offer originated and whether another reliable source confirms it.
Avoid sending money to unlock money. Be especially cautious if a job, prize, investment or refund requires you to pay a fee, purchase equipment or transfer money first.
How McAfee Is Changing to Meet This Moment
As AI changes how people create, communicate and connect, consumer protection needs to evolve with it.
McAfee has been protecting people for decades, and for many people, our name is still synonymous with antivirus. Today’s digital lives extend far beyond a single device, and the risks people encounter do too.
The new McAfee experience is designed to help protect the things people rely on every day, including their personal information, connections, devices and accounts, while making it clearer what’s safe, what needs attention and what McAfee can handle for them.
That includes helping identify suspicious messages, links and websites, alerting people when personal information appears in a data breach, monitoring for exposed personal information, helping protect connections on risky Wi-Fi and keeping devices and accounts safer.
The experience is built around three principles:
Simple and easy. McAfee does more of the work so people don’t need to understand complex threats, security terminology or which setting they need to find.
Personalized and proactive. McAfee surfaces timely alerts when information or devices may be at risk, with guided actions that explain what is happening and what to do next in plain language.
Always-on and unified. Protection for personal information, connections and devices comes together in one connected experience across devices, helping people stay protected wherever their digital lives take them.
The goal is to help identify risk earlier and give people clearer guidance in the moment, reducing how much of the burden they have to carry themselves.
Navigating the New Scam Reality
Gen Z’s digital fluency has developed alongside the internet itself. Now the internet is changing again.
AI is lowering the barrier to creating realistic fake content, while many of the interactions young adults depend on, including friendships, job searches, shopping, banking and entertainment, happen online.
The answer cannot be expecting people to become experts at identifying every new AI trick.
A security breach at the Pentagon’s Defense Manpower Data Center (DMDC) exposed unencrypted personal and military records for approximately 3.05 million individuals between October 2025 and July 2026. First reported by Military Times on September 24, 2026, the intrusion compromised sensitive files, including Social Security numbers, belonging to active-duty personnel, veterans, and deceased service members.
With official notification letters dated September 18, 2026, now arriving in physical mailboxes, affected individuals can determine their exposure and enroll in 12 months of free credit monitoring and identity restoration services provided by the Department of Defense through IDX. Understanding the full scope of the incident, confirming whether your records were involved, and establishing immediate account and credit safeguards are essential steps to shielding military benefits and personal finances from targeted exploitation.
How the DMDC Data Breach Happened and What Data Was Compromised
The breach occurred when unauthorized actors exploited a software vulnerability in a DMDC file-sharing system, maintaining access to a server holding unencrypted personnel data for nine months. According to official notification letters mailed by the DMDC on September 18, 2026, unauthorized users accessed personal and military service files between October 2025 and July 2026.
The Pentagon did not issue a public press release prior to dispatching physical mailings. Community members first raised public awareness by sharing letter excerpts on Reddit’s r/Veterans. Pentagon officials confirmed to CNN that the breach compromised records for 2.76 million living individuals and 294,000 deceased service members.
The exposed server contained unencrypted personally identifiable information (PII) belonging to service members, veterans, and military dependents. Compromised records include full names, Social Security numbers, dates of birth, contact information, and administrative military service details.
How to Know If Your Information Was Exposed in the Pentagon Breach
The primary notification method for this incident is a physical letter sent via the United States Postal Service. The DMDC began mailing official breach notification letters dated September 18, 2026, directly to affected personnel, veterans, and surviving family members.
The Pentagon has not released an online lookup database to verify individual exposure. The incident affects individuals whose personnel, manpower, or benefits records were stored on the compromised server during the nine-month exposure window, spanning active-duty military, reserve personnel, National Guard, defense civilians, contractors, veterans, and eligible dependents.
If you have moved recently, your notification letter may be delayed or returned to sender. Log in to milConnect to confirm that your mailing address and contact details are current within the Defense Enrollment Eligibility Reporting System (DEERS). If your records were maintained in DMDC systems between October 2025 and July 2026, take proactive security steps even before a physical letter arrives.
Red Flags That Cybercriminals Are Using Your Military Data
When personal and military records leak, cybercriminals routinely use the data to stage targeted impersonation schemes and financial fraud. Watch for these warning signs:
Government impersonation attempts: Unsolicited calls, emails, or text messages claiming to be from the Department of Defense (DOD), Department of Veterans Affairs (VA), or TRICARE requesting verification of personal identifiers.
Benefit redirection notices: Unexpected alerts regarding direct deposit changes, login credential updates, or profile modifications across military portals that you did not initiate.
Phony breach assistance solicitations: Unofficial communications offering expedited claims, settlements, or data removal services in exchange for an upfront fee or account numbers.
Unexplained credit or loan activity: Inquiries on your credit report, new credit card accounts, or collection notices for debt you do not recognize.
Unexpected tax or benefit filings: Notifications from the IRS or state tax authorities stating that a tax return or benefit claim has already been filed in your name.
How Military Personnel Can Protect Themselves
Military personnel and service members should take immediate steps to restrict access to their credit profiles and personal accounts:
Enroll in free credit monitoring through the official IDX portal. The Defense Department is offering 12 months of free credit monitoring and identity restoration services to affected individuals through IDX. If you received a breach notification letter, use the unique enrollment code included in the mailing to register on the official IDX DMDC response portal or call the support line directly at 1-855-744-4556.
Place a credit freeze with all three credit bureaus. Contact Equifax, Experian, and TransUnion to freeze your credit files. A credit freeze blocks prospective lenders from accessing your credit report, stopping identity thieves from opening loans or lines of credit with your Social Security number.
Enable multi-factor authentication on defense portals. Log in to MilConnect, VA.gov, and MyPay to update passwords and enforce multi-factor authentication (MFA). Use an authenticator app or hardware security key rather than SMS verification where available.
Verify official contacts independently. The DOD, DMDC, and VA do not initiate contact via phone, text, or email to demand immediate payment or confirmation of your Social Security number. Verify any inquiry by navigating directly to official .gov domains.
Inspect TRICARE and medical billing statements. Review Explanations of Benefits (EOBs) and medical statements closely. Confirm that all listed provider appointments, diagnostic tests, and prescription orders match care you actually received.
What Military Personnel Should Do If Their Data Was Compromised
If you received an official DMDC notification letter dated September 18, 2026, or notice unauthorized activity on your accounts, execute the following recovery steps:
File an identity theft report with the FTC. Submit an official report through the Federal Trade Commission identity theft portal to establish your legal rights and dispute fraudulent accounts with creditors and banks.
Obtain an IRS Identity Protection PIN (IP PIN). Prevent fraudulent tax filings using your exposed Social Security number by applying for a six-digit IP PIN through the Internal Revenue Service identity protection page.
Place an extended fraud alert on your credit file. If you choose not to freeze your credit entirely, request an extended fraud alert, which requires lenders to verify your identity before approving credit in your name.
Notify your financial institutions. Contact the fraud divisions of your bank and credit card issuers to review account statements, replace compromised account numbers, and set up real-time transaction alerts.
Retain all breach correspondence. Keep physical copies of your DMDC notification letter, agency complaints, police reports, and dispute logs for ongoing tracking.
How Military Personnel Can Report Fraud and Suspicious Activity
Report security incidents, fraudulent accounts, and impersonation attempts directly through official federal reporting channels:
Department of Defense Inspector General: Report military personnel data misuse or military identity impersonation via the Department of Defense Hotline.
FBI Internet Crime Complaint Center (IC3): File an online cybercrime complaint regarding credential misuse or unauthorized financial compromise through the FBI Internet Crime Complaint Center.
Local Law Enforcement: File a formal police report with your municipal department if an unauthorized party obtains loans, opens accounts, or conducts financial transactions in your name.
Because Social Security numbers and military service records cannot be readily changed, exposure from the DMDC breach presents a persistent risk for active personnel and veterans. Taking proactive security measures now, such as enrolling in the IDX identity monitoring program, locking down credit files, securing military accounts with multi-factor authentication, and reporting suspicious contact immediately, is critical to preventing long-term identity exploitation.
On October 6, 2026, the ASOS push notification hack sent unauthorized messages to millions of customer devices after cybercriminals accessed a connected third-party platform. ASOS, a British online fashion and cosmetic retailer serving active shoppers worldwide, confirmed that an attacker compromised employee credentials to access external systems. As reported by BBC News, the intrusion exposed customer contact records and personal search histories, although company representatives confirmed that banking and payment information was not accessed.
How the Attack and Social Engineering Breach Worked
The unauthorized messages originated from an extortion ring calling itself the Xuanyewen hacker group. The intruders hijacked the ASOS mobile shopping app interface to broadcast rogue alerts directly to users, claiming they had extracted full customer databases.
The breach did not stem from a software flaw within the ASOS mobile application. Instead, the intruders relied on social engineering, impersonating a trusted contact to deceive an employee into providing valid system credentials.
Those credentials allowed the attackers to sign in to Simon AI, a third-party marketing and personalization platform built on Snowflake Cortex AI that ASOS uses to power customer communications. Once logged in, the threat actors initiated app-wide push alerts and exfiltrated audience data containing customer personal data.
Clarifying the Snowflake Breach Claims
During the intrusion, the hackers claimed they had carried out a direct Snowflake breach to compromise ASOS’s central databases. Official statements from both platforms quickly refuted that claim.
In a corporate statement released through Snowflake’s official statement via Alliance News, a Snowflake spokesperson stated: “We can confirm this issue did not in any way result from a vulnerability, weakness, flaw, or misconfiguration with the Snowflake service… and was not caused by Snowflake.”
Independent reporting and corporate disclosures confirm that the compromise occurred exclusively at the third-party marketing integration layer. Attackers frequently target peripheral marketing tools using stolen credentials because these platforms handle live customer segments without requiring direct access to locked-down corporate networks.
Warning Signs That Your Personal Data Was Compromised
The data accessed during the incident included more than basic contact lists. As documented by BBC’s reporting, data samples provided directly by the threat actors revealed specific customer search histories, including search terms such as “reclaimed vintage.”
In the official ASOS customer breach notification, the retailer stated they did not believe that payment card numbers, banking details, and account passwords were accessed, as those are stored on separate, isolated transactional systems. However, exposed contact information and shopping preferences still present risks for targeted follow-up fraud. Watch for these warning signs that your personal data was exposed:
Unsolicited push messages: App notifications prompting you to verify your identity, visit external chat platforms, or click unverified links.
Tailored phishing emails: Messages referencing specific clothing brands, recent browsing queries, or recent order details designed to trick you into revealing passwords.
Unrequested authentication codes: Password reset messages or multi-factor prompts that you did not initiate.
Direct contact from extortionists: Unsolicited communications via email or messaging apps claiming to hold your retail browsing data.
How to Protect Your Personal Data
Taking direct defensive steps helps minimize the risk of identity theft or secondary phishing. Use these best practices to protect your personal data:
Avoid clicking unexpected push notification links: If you receive an unexpected alert about an account security issue, dismiss the message and sign in through an official web browser instead.
Update your account password:Create a strong, unique password for your ASOS account that is at least 12–16 characters long and not shared across any other platforms.
Enable multi-factor authentication (MFA): Set up MFA across your primary email and retail accounts, opting for an authenticator app over SMS codes whenever available.
Verify retailer messages independently: If you receive an email regarding an order change or account issue, visit the store’s website directly rather than using embedded links.
What to Do If Your Personal Data Was Compromised
If your personal details were exposed or you interacted with the rogue push alert, take these containment measures:
Cease all contact with extortionists: Do not communicate with extortionists or send payments to individuals offering to delete stolen records.
Change shared account credentials: If you used your ASOS password on other websites, update those services with unique login combinations immediately.
Place a credit freeze: Contact the three major credit reporting agencies—Equifax, Experian, and TransUnion—to freeze your credit files against unauthorized new accounts.
Monitor financial statements: Check linked credit card and bank statements for unauthorized charges or low-value test transactions.
Create an identity recovery plan: If sensitive contact or identity records were exposed, file a report at the federal government’s IdentityTheft.gov recovery portal to document the incident and receive a recovery plan.
Preserve digital evidence: Keep screenshots, message headers, and timestamps of any suspicious texts, emails, or calls you receive.
How to Report Identity Threats and Extortion
Reporting incidents to official oversight agencies helps authorities identify threat infrastructure and take down fraudulent operations:
The ASOS App push notifications incident highlights how cybercriminals bypass central infrastructure by using social engineering to compromise connected third-party tools. Practicing strong credential hygiene, staying alert to targeted phishing messages, and reporting suspicious contact to regulators are your most effective steps for keeping your personal information secure.
A new cyberattack is weaponizing everyday search results to trick users into running malicious code on their devices. The campaign, dubbed “Adception,” was uncovered by Push Security. By buying paid search ads on Google and routing traffic through trusted web services, attackers are placing deceptive links directly in front of people searching for popular software. Then, they use a social engineering framework known as “ClickFix” to trick people into running malicious scripts on their devices.
How the Adception Campaign Works
Search ads appear at the very top of search engine results, making them easy to click and easy to trust. Malvertising (short for malicious advertising) occurs when cybercriminals buy or hijack legitimate ad placements to spread malware or direct users to fraudulent websites. In this campaign, attackers purchase legitimate ad slots but route clicking visitors through a hidden chain of web redirects before loading a fraudulent website. This detour conceals the final destination from automated ad-review crawlers, allowing malicious ads to bypass platform security filters and reach active searchers.
According to Push Security’s research, the threat actors specifically targeted Mac users searching for Anthropic’s Claude AI assistant. To evade automated detection, the attack chain bounces traffic through legitimate Bing click-tracking redirects and a compromised website. Once a visitor lands on the fake software portal, the attackers deploy an evasion technique known as “ClickFix,” using deceptive troubleshooting prompts to trick macOS users into executing base64-encoded malware directly inside the Z shell (zsh).
The campaign executes across five distinct stages:
Sponsored Search Ad Placement: Attackers purchase top-ranked Google search ads that bid on keywords for Anthropic’s Claude desktop app.
Cross-Engine Redirection (Google to Bing): Clicking the Google ad routes the visitor through legitimate Bing click-tracking infrastructure. The attackers use this cross-engine detour because automated Google ad-review crawlers do not expect ad traffic to route through a competitor’s tracking domain, effectively blinding them to the ultimate destination.
Compromised Intermediary Site: The traffic forwards to a compromised WordPress site owned by a South American retailer, which runs two layers of cloaking to weed out automated scanners and non-Mac operating systems.
Deceptive Landing Page: Qualifying visitors land on a counterfeit webpage that closely mimics Anthropic’s official website and branding.
ClickFix Terminal Execution: The landing page displays a fake installation error and activates the “AcSig” ClickFix toolkit, which hijacks the user’s clipboard and instructs them to paste code into the macOS Terminal to “fix” the download.
Warning Signs of Deceptive Search Ads
Unfamiliar or shifting URLs: The address displayed on the ad card does not match the real software vendor, or your browser rapidly redirects through multiple unrelated domains before loading.
Terminal or command-line prompts: When you arrive at a website through a search ad, it instructs you to open your computer’s terminal, shell, or command prompt to complete a download or resolve an installation error.
Clipboard hijack instructions: The webpage asks you to copy code or automatically copies script text containing terms like base64, eval, curl, or zsh into your system clipboard.
Fake system repair messages: On-screen pop-ups claim your browser or operating system requires an immediate manual patch to proceed with a standard download.
How to Protect Yourself from Deceptive Search Ads
Navigate directly to official vendor sites. Type known web addresses directly into your browser’s address bar rather than searching for download portals.
Verify the destination URL before clicking. Inspect the displayed web address on search results to ensure it matches the actual company domain.
Use automated web protection tools: Install a secure browsing extension to automatically protect against malware and phishing sites.
Never paste unverified code into command-line tools. Legitimate commercial software does not require pasting terminal commands to resolve browser download issues.
Use official application stores. Download desktop applications directly through official developer portals, the Mac App Store, or the Microsoft Store.
What to Do If You Interacted with a Malicious Ad
If you clicked a deceptive ad and pasted code into your Mac’s Terminal, assume your device has been compromised. Take these immediate steps to limit the damage:
Disconnect from the internet immediately. Turn off your Wi-Fi from the menu bar at the top of your screen and unplug any network cables. This cuts off communication between your computer and the attacker’s server.
Shut down the Terminal and turn off your Mac. Quit the Terminal app completely. Shut down your computer to stop any background scripts from continuing to run.
Change your passwords from a different device. Using your phone or a separate, clean computer, immediately update passwords for your primary email, online banking, and password manager. When prompted, choose the option to “Log out of all devices.”
Turn on two-factor authentication (2FA). For any critical accounts that don’t already have it, enable two-factor authentication using an authenticator app rather than SMS text messages.
Run a full antivirus scan. Restart your Mac, keep Wi-Fi turned off, and run an offline security scan using reputable antivirus software to detect and quarantine any installed files.
Avoid sensitive logins and seek professional help if uncertain. Do not sign into online banking, email, or password accounts on the affected computer. If your security scan cannot confirm the threat is gone or you feel unsure, take the device to an Apple Store or certified technician to safely wipe and reinstall the operating system.
How to Report Deceptive Ads
Report rogue ads to Google: Submit an abuse report via the Google Ads Complaints Form to flag fraudulent ad links and advertiser accounts.
Notify the impersonated vendor: Alert the affected brand’s support team to inform them of active trademark abuse and domain spoofing.
Deceptive search ads succeed by exploiting everyday browsing habits and the assumption that top-ranked search results are safe. Taking a moment to verify destination URLs and reporting suspicious sponsored listings helps platforms dismantle malicious infrastructure and keeps the broader online community safer.
Security researchers at Jamf Threat Labs issued a September 2026 threat report warning Mac users about a newly discovered malware program called “CloudSyncD.” Disguised as a Zoom installer on unverified download sites, this malicious software tricks users into entering their administrator password, allowing attackers to secretly take remote control of the computer. The campaign targets individuals looking to install or update the popular video conferencing software.
How the CloudSyncD Malware Works
For a detailed technical breakdown of how the malware operates, you can read the full Jamf Threat Labs report. In simple terms, when someone downloads and opens the fake Zoom installer, the malware enacts a process to take control of the Mac:
Fake System Prompt: The installer opens a pop-up window asking for your computer password, designed to look like an official macOS prompt.
Hidden Credentials: Once typed, the malware saves your password in a disguised file, hiding the text with invisible characters to bypass standard checks.
Silent Setup: Using administrative privileges, the malware quietly installs a hidden background program on your system.
Remote Access: The background program connects your Mac to an attacker’s server, granting hackers full remote access to run commands, steal files, or install additional software.
Malicious Installer Warning Signs and Red Flags
Recognizing a suspicious installer before opening it prevents system compromise:
Unofficial Download Sources: The file originates from a sponsored search link, file-sharing site, or third-party portal rather than the software’s official web page or the official Mac App Store.
Immediate Password Requests: A system password prompt appears right when opening a disk image before any setup wizard begins.
System Security Warnings: macOS Gatekeeper or XProtect displays an alert stating the software is untrusted or lacks a recognized developer signature.
Unfamiliar Background Processes: Unknown applications or scripts execute with administrative privileges in macOS Activity Monitor.
How to Protect Your Mac From CloudSyncD and Other Malware
Adopting safe download practices reduces the risk of installing malicious macOS software:
Download exclusively from official sources: Always obtain applications directly from the developer’s official website or the Mac App Store.
Verify unexpected password prompts: Cancel any password request that appears unexpectedly when opening a newly downloaded file.
Keep macOS security features active: Ensure built-in protections like macOS Gatekeeper and XProtect remain turned on to flag unverified software.
Check app signatures before opening: Inspect installer details and developer certificate signatures before approving setup.
What to Do If You’ve Already Used a Fake Zoom Installer
If you downloaded a fraudulent Zoom installer or entered credentials into a suspicious prompt, execute these recovery steps immediately:
Disconnect from the Internet: Turn off Wi-Fi and unplug Ethernet cables right away to break active communication between your Mac and remote servers.
Change Account Passwords: Using a separate, secure device, update your Mac administrator password and any account credentials accessed from that computer.
Turn On Multi-Factor Authentication: Enable multi-factor authentication (MFA) across your financial, email, and personal accounts.
Isolate and Remove Malicious Artifacts: Run a full system scan or work with a technical professional to locate and delete unauthorized background files.
Place a Credit Freeze: If personal or financial data was stored on the computer, place a credit freeze with Equifax, Experian, and TransUnion.
Report Fraudulent Installers and Secure Your Mac
Reporting malicious downloads helps threat intelligence researchers and federal agencies track active campaigns. Submit reports regarding fraudulent software installers to the FBI Internet Crime Complaint Center or the Federal Trade Commission. Notifying the official security team of the impersonated service provider also assists in taking down fake download domains.
Because CloudSyncD installs persistent background files, completely removing every component is essential to restoring system security. Simply deleting the downloaded installer disk image does not eliminate the threat. Ensure all hidden binaries and configuration files are thoroughly purged from your system to revoke remote access and protect your data.
On October 2, 2026, attackers hijacked Microsoft’s official X account (which reaches over 13 million followers) to execute a cryptocurrency pump-and-dump scheme, as reported by The Verge. The unauthorized access allowed attackers to replace Microsoft’s profile image with its retro mascot Clippy and promote a fraudulent token called $Clippy before the posts were removed. An official statement on Microsoft’s X account confirmed the account was secured, the unauthorized posts were deleted, and an internal investigation into the breach is ongoing.
How the $Clippy Crypto Scam Worked
When cybercriminals gain control of a verified corporate account, they leverage its built-in credibility to trick followers into fake financial investments.
Unauthorized actors gained access to @Microsoft on October 1, 2026. The attackers changed the account’s profile picture to image assets of Clippy, Microsoft’s legacy virtual assistant, and retweeted promotional posts from an impersonator handle, @clippymsftcto.
The malicious posts directed users to external sites promoting a fraudulent $Clippy cryptocurrency token. To confuse followers and delay remediation, the attackers also published a fake apology tweet from @Microsoft claiming control had been restored while continuing to promote the scam. Account access was eventually restored, and X suspended the associated impersonator accounts.
Warning Signs That an Account Has Been Compromised for a Crypto Pump-and-Dump
Sudden profile changes: Abrupt alterations to official branding, logos, bios, or handles accompanying high-yield investment offers.
High-pressure purchasing tactics: Posts creating artificial urgency by urging followers to buy unlisted tokens or connect wallets before a deadline.
External wallet connection links: Unfamiliar links directing users to third-party decentralized finance platforms or signature-draining websites.
Contradictory apology posts: False status updates or fake “all-clear” statements published during an active breach that still include external links or contract addresses.
How to Protect Yourself from Social Media Crypto Scams
Cross-reference announcements on official newsrooms: Confirm product or financial launches on a company’s main website before trusting social media posts.
Avoid clicking direct links for token sales: Never interact with link shorteners or unfamiliar domains asking you to connect a digital wallet.
Audit token contracts independently: Use reputable blockchain analytics tools to check liquidity, developer wallet allocations, and contract safety before buying new tokens.
Remember that verified badges do not guarantee immunity: Blue checkmarks confirm identity verification, but they do not prevent credential theft, session hijacking, or account takeovers.
What to Do If You Have Already Been Targeted
Disconnect wallet permissions immediately: Use security tools to cancel active smart contract allowances granted to suspicious sites.
Transfer remaining assets: Move funds to a newly generated, secure wallet if you suspect your private keys or seed phrases were compromised.
Contact your financial institutions: Notify your bank, credit card company, or crypto exchange immediately if fiat currency or linked accounts were involved.
Change passwords and enable multi-factor authentication (MFA): Update credentials across all sensitive accounts using an authenticator app rather than SMS.
Document transaction evidence: Save wallet addresses, transaction hashes, screenshots of fraudulent posts, and web links for formal reports.
Report identity exposure: If you shared personal identity or banking details on a phishing site, submit a report to the FTC and get a recovery plan.
How to Report Social Media Crypto Scams
If you encounter or fall victim to a social media crypto scam, report cyber fraud directly to the FBI Internet Crime Complaint Center and deceptive financial schemes to the Federal Trade Commission. You can also flag hijacked profiles or scam links using on-platform reporting tools directly on X, or contact local law enforcement if you suffered significant financial losses.
High-profile corporate account hijacks demonstrate how quickly bad actors can exploit trusted brands to promote fraudulent schemes. Verifying financial news across primary corporate websites, auditing token contracts, and recognizing red flags remain critical steps to keeping your digital assets secure.
Frontline Education, which makes K–12 school administration software, is notifying more than 1.3 million school employees and students that their personal information was stolen in an August 2026 breach. That count comes from filings in five states, SecurityWeek reported on Nov. 3, 2026, and the full total is likely higher.
The exposed data varies by person but can include Social Security numbers, dates of birth, driver’s license and passport numbers, Medicaid IDs, and Student IDs, according to Frontline’s Oct. 26 notice. Frontline serves more than 10,000 K–12 organizations nationwide.
Did You Get a Frontline Education Breach Letter or Email?
Frontline began sending individual notices on or about Oct. 26, 2026, by email or by U.S. mail. The mailed letter’s return address reads “Frontline Education c/o Cyberscout, PO Box 1286, Dearborn, MI 48120-9998,” according to the sample letter Frontline filed with the California attorney general. Cyberscout, a TransUnion company, is handling mailings and monitoring on Frontline’s behalf. District administrators received earlier emails from frontline@notifications.cyberscout.com starting Oct. 1.
What’s offered: Adults get 24 months of free TransUnion credit monitoring. Enroll at mytrueidentity.com with the activation code in your letter. Minors are offered free cyber monitoring.
Deadline: Enroll by the date in your letter (Jan. 31, 2027, on the sample notice). Your code won’t work after the date in your letter.
How to confirm it’s real: Don’t call numbers or click links in an unexpected message. Call the TransUnion call center listed in Frontline’s notice, 1-800-759-7279 (8 a.m. to 8 p.m. ET, Monday through Friday), or check with your district’s HR department or main office.
Spanish: A Spanish version of the letter template is at frontline-transunion.com/Spanish.
What Happened in the Frontline Education Data Breach
On Aug. 14, 2026, Frontline’s security team found that a vulnerability in third-party software it uses had allowed unauthorized access to part of its environment. The last unauthorized activity was Aug. 15. Frontline says it fixed the vulnerability, investigated with an independent cybersecurity firm, and contacted law enforcement. It has not named the software or the attackers, and it says it is not aware of any misuse of the data.
The breach affected two Frontline products: Frontline Central, which districts use for employee records, and School Health Management, which school nurses use to document student health care. That is why both staff and students are getting notices. The exposed information varies by person and can include:
Names, home addresses, and email addresses
Social Security numbers and dates of birth
Driver’s license numbers, passport numbers, and other government ID numbers
Medicaid IDs
Student IDs
Who has been notified so far:
What was exposed depends on which Frontline products a district used. Some districts report only employee data, and others report student data.
Five states: Filings in Massachusetts, New Hampshire, South Carolina, Texas, and Vermont total 1,298,917 people, SecurityWeek reported. Frontline also filed notices in California, Indiana, and Iowa, so the full count is likely higher.
South Carolina: The state’s breach notice registry lists 493,535 affected residents, eSecurityPlanet reported.
Killeen ISD (Texas): About 45,000 current and former employees and others. The district said no student information was involved.
Greenwood School District 50 (South Carolina): About 16,678 current and former students. Exposed data may include Medicaid ID numbers and contact details. [VERIFY]
Warning Signs That Your Personal Information was Compromised in a Data Breach
Because compromised Social Security numbers and contact details enable identity theft and targeted phishing, school employees and parents should watch for these specific warning indicators:
Unsolicited verification requests: Emails or calls claiming to represent Frontline Education, Cyberscout, or district HR asking you to confirm personal details, login credentials, or your monitoring activation code.
Targeted phishing (spear phishing): Messages addressing you by name and referencing your specific school district, job title, or administrative role.
Unfamiliar credit inquiries: Alerts from credit monitoring services showing credit checks or new account applications that you did not initiate.
Tax filing irregularities: Communications from the IRS or state tax authorities indicating that a tax return has already been filed using your Social Security number.
Health coverage you didn’t use: Medicaid or health plan statements, or benefit notices, for care or services you didn’t receive.
Activity in a child’s name: Credit offers, IRS notices, or collection calls addressed to a student.
How School Staff and Parents Can Protect Themselves
If you work or worked for a school district that uses Frontline, or your child attends or attended one, take these steps:
Enroll in the free monitoring by the date in your letter. Adults can enroll at mytrueidentity.com with the activation code in their letter. Minors are offered free monitoring.
Freeze your child’s credit. Parents and guardians can request a free credit freeze for children under 16 at Equifax, Experian, and TransUnion. Each bureau creates a file for the child and freezes it, which blocks new accounts in the child’s name.
Review health coverage statements. If your letter lists a Medicaid ID, check Medicaid or health plan statements for visits, prescriptions, or services you didn’t receive.
Freeze your credit, or place a fraud alert. A freeze has to be placed separately at Equifax, Experian, and TransUnion. A fraud alert needs only one bureau, which notifies the other two. A credit freeze prevents lenders from accessing your credit report, stopping bad actors from opening unauthorized accounts in your name.
Verify the notice before you act. Confirm with your district’s HR department or main office that your district was affected, or call the TransUnion call center listed in Frontline’s notice. Don’t call numbers or click links in an unexpected message.
Enable multi-factor authentication (MFA). Turn on MFA across all personal email accounts, financial portals, and school district access systems to prevent unauthorized sign-ins.
Monitor credit reports at the source. Request free annual credit reports through the official annual credit report website to review active accounts and financial inquiries.
What to Do If You Have Already Been Targeted
If your or your child’s Social Security number or personal financial details have already been misused, complete the following recovery steps immediately:
Stop contact with suspicious senders. Do not reply to unverified emails, texts, or phone calls requesting additional personal information.
Notify your financial institutions. Contact your bank, credit card issuers, and payment providers to alert them of potential identity theft and place fraud holds on compromised accounts.
Report identity theft to the federal government. File an official identity theft report at the FTC identity theft portal to receive a recovery plan and official documentation for disputing fraudulent accounts.
Freeze your credit. If you have not yet frozen your credit, do so immediately with Equifax, Experian, and TransUnion.
Change affected account credentials. Update passwords for primary email accounts and school portal logins. Use complex, unique passwords for every service.
File a report with local law enforcement. If you incur financial losses or discover fraudulent accounts opened in your name, submit a police report and request a copy for your dispute records.
Maintain detailed documentation. Retain copies of notification letters, email headers, police reports, and fraudulent transaction statements.
How to Report the Threat and Next Steps
To report suspicious activity or document fraudulent use of your information resulting from this incident, use official reporting channels:
As of November 2026, Frontline’s notices are still going out, and new district and state counts are still being posted. If you got a letter or email, enroll in the free monitoring by the date in your letter, and freeze your credit, and your child’s, with Equifax, Experian, and TransUnion. Treat any call, text, or email about this breach that asks for your Social Security number or activation code as a scam until you confirm it through your district or the call center number in Frontline’s notice. Automated monitoring tools can alert you if your exposed information appears online.
Login
.gif)
