Last week my toilet paper ordering website account was breached. Yes, really. Toilet paper. I work in IT and talk about cyber security almost daily but my data was breached in the most unexpected of places.
I received an email in the late evening letting me know what had happened:
“What was involved
The personal information involved was your first and last name, email address, phone number, mailing address and the total amount you’ve spent with *redacted company name*.
Importantly, it did not include payment details, order details or passwords.”
Then a couple of nights ago I got another data breach email, this time from a site I have bought sewing patterns from.
“What information could be concerned?
The information you have provided to us, for example when creating an account or placing an order, and depending on what you entered: name, e-mail address, postal address, phone number and order history. For some card payments, the last 4 digits of the card, which cannot be used to make a payment, and, where applicable, any documents sent via our contact form.”
And so, I had a sleepless night trying to work out where (in the hundreds of websites I would have signed up for over the years) I might have residual weak passwords hanging on from days before I worked in IT and started thinking about cybersecurity.
Think about how many websites/Apps you’ve signed up to over the years. Online shopping, Uber Eats, subscriptions, loyalty programmes, delivery services and all those random accounts you created because you needed something once. They all hold quite a bit of personal information. And when these companies experience a data breach, we often have very little control over what happens next. So, rather than panic every time another breach notification lands in our inbox, here’s what I think we should actually be doing.
First, what information have they actually lost?
Before doing anything else, find out what was involved in the breach. There’s a big difference between someone getting hold of your email address and someone getting access to your driver’s licence, date of birth or payment information.
When an organisation contacts you, ask:
- Was my name and email address exposed?
- Was my home address or phone number included?
- Was my date of birth accessed?
- Were my passwords compromised?
- Were payment or credit card details involved?
- Were any identity documents stored in the account?
- Has the information actually been accessed or downloaded by an unauthorised person?
Don’t be afraid to ask questions. It’s your information, after all.
The New Zealand Privacy Commissioner says organisations should explain what information was involved and what steps they’re taking to deal with the breach.
You can find more information at privacy.org.nz.
Change your passwords. ESPECIALLY passwords you’ve repeated.
If the breached website held a password that you’ve used elsewhere, change it. This is particularly important for your email, banking and other important accounts.
Reusing passwords is one of the easiest ways for criminals to move from one compromised account to another.
My advice:
- Use a different password for every account.
- Change passwords that may have been exposed.
- Turn on two-factor authentication wherever possible.
- Check that your email recovery details are correct.
- Review logged-in devices and remove anything you don’t recognise.
Keep an eye on your bank accounts
Even if the organisation that was breached wasn’t your bank, it’s worth checking your financial accounts. If payment details were involved, contact your bank and ask whether your card needs replacing. If they weren’t involved, there’s no reason to immediately cancel every card you own. Just keep an eye on transactions and report anything suspicious. It’s also worth remembering that criminals don’t always use stolen information immediately. Sometimes they sit on it and use it much later.
What about identity theft?
This is where things become a little more serious. Your name, date of birth, address and other personal details can potentially be used to impersonate you or apply for credit in your name. If identity documents such as your passport or driver’s licence were exposed, contact the relevant issuing authority and ask what precautions you should take. In New Zealand, you can also request a credit file suppression (sometimes called a credit freeze) if you believe you’re a victim of identity fraud. The New Zealand Privacy Commissioner explains how this works.
You can contact:
An initial suppression can prevent credit reporting information from being disclosed to new credit providers for 10 working days while the situation is investigated. You can ask about extending it if necessary. You don’t necessarily need to do this because a shopping account was compromised. But if identity information has been exposed, it’s worth knowing the option exists.
Beware of the scammers who come crawling out afterwards
This is probably one of the things that concerns me most. After a major data breach, scammers may have enough information about you to make their messages sound incredibly convincing. Imagine getting a phone call from someone who knows your name, address and which company recently experienced a breach. They sound legitimate, don’t they? They might claim they’re from your bank, the affected company or even a government department trying to help you.
Be careful!
Never give someone your banking password, PIN, one-time verification code or remote access to your computer because they’ve contacted you unexpectedly. If you’re unsure, hang up and contact the organisation directly using its official website or published phone number. Also, don’t click links in unexpected breach notification emails. Go directly to the organisation’s website instead.
New Zealanders: There is help available
If you discover your information has been compromised, there are some useful organisations in New Zealand that can help.
IDCARE
This is a particularly useful service. IDCARE provides free support to people affected by identity theft and cybercrime in New Zealand and Australia. They can help you work out what information has been compromised and what steps you should take.
Website: https://www.idcare.org/
New Zealand Privacy Commissioner
If you want to understand your privacy rights, find out what an organisation should have done or make a complaint about how your information was handled, this is the place to start.
Website: https://www.privacy.org.nz/
Netsafe
Netsafe provides advice and support around online safety, scams and privacy breaches.
Website: https://netsafe.org.nz/
New Zealand National Cyber Security Centre (NCSC)
You can report cybersecurity incidents and get advice about protecting your information.
Website: https://www.ncsc.govt.nz/
New Zealand Government
There’s also a useful government guide explaining what to do if your personal information has been stolen.
My approach? Don’t panic, but don’t ignore it either.
If a website where I buy toilet paper has been breached, I’m not immediately assuming someone is going to steal my identity and take out a mortgage in my name. But I am going to check what information was exposed, change any affected passwords and keep an eye out for anything unusual. And if the breach involves more sensitive information, I’ll take the appropriate extra precautions.
I also think we should be asking more questions of the organisations holding our information. Why do they need so much of it? How long are they keeping it? What are they doing to protect it? And why are customers so often left dealing with the consequences when something goes wrong? We hand over our personal information because we need to use their services. That doesn’t mean we should have to accept poor security as part of the deal.
The bottom line
Data breaches are becoming an increasingly frustrating part of modern life. We can’t personally prevent every company we deal with from being hacked. But we can make it harder for criminals to use our information. Change compromised passwords, use two-factor authentication, keep an eye on your finances, be suspicious of unexpected messages and find out exactly what information has been exposed.
And perhaps think twice before creating yet another online account just to order something you could probably buy at the supermarket.
Although, let’s be honest, having toilet paper delivered is super convenient.
Stay alert, stay sensible and make it as difficult as possible for a small data breach to snowball into a big issue!