How to test a data breach claim before believing or sharing it
Breach claims often spread on social media and forums within hours, frequently before anyone has verified them. Many are old leaks repackaged, scraped public data, or stitched-together lists, so a claim should be treated as an allegation until the organisation, CERT-In, a regulator or a credible researcher confirms it. Experts advise checking the source's track record and whether the record counts and fields are internally consistent. They also warn against downloading leaked samples, which carry legal risk and malware dangers. Individuals can check their own exposure through Have I Been Pwned and should change reused passwords and enable two-factor authentication. Under CERT-In's 2022 directions, specified cyber incidents must be reported within six hours of being noticed.
