Scammers Follow the Breach Headlines
When a data breach makes the news, scammers read the same coverage you do, and they use it.
A message that arrives right after a breach, claims to be from the company involved, and asks you to act quickly should be treated as suspect until you verify it yourself, through a channel you already trust.
The pattern the FTC describes
The Federal Trade Commission puts the pattern in plain terms — in its words, "Scammers follow the headlines" — and describes scammers as using what is happening in the news to find new ways to persuade people to hand over their money.
The FTC makes the same point in its phishing guidance, noting that scammers regularly adjust their tactics to match the latest news or trends.
A breach creates worry, and worry makes a fake alert easier to believe. The headline does part of the work, and a familiar phishing message does the rest. The basic checks in the briefing "Spot the phish before you touch the bait" apply here too — a post-breach lure is still a phishing message, just with a current headline attached.
How the phishing message works
The FTC describes phishing emails and text messages as telling a story designed to get you to click a link or open an attachment. A message may arrive unexpectedly and look like it is from a company you know or trust, like a bank or a credit card or utility company.
Common tactics include claiming suspicious activity or log-in attempts, claiming a problem with your account or payment information, saying you need to confirm personal or financial information, or wanting you to click a link to make a payment.
After a breach, that story writes itself. Two phrases show the shape of it: "verify your account now" and "claim free credit monitoring." Those are illustrative examples, not documented incidents from a specific breach. They match the FTC's description — a claimed account problem, a request to confirm information, and a link to click — dressed up in breach language. The text-message version is covered in the briefing "Can You Spot the Smish? Package Text Quiz".
What happened after the Anthem breach
There is a documented example of this pattern. After the Anthem data breach, scammers sent phishing emails with malicious links offering "free credit reporting," according to a phishing guide from the Illinois Emergency Management Agency that cites the FTC.
That example is worth keeping separate from the illustrative phrases above. "Free credit reporting" is the wording from that documented incident. It shows why the pattern works: after a real breach, an offer of free help sounds like a reasonable response from the company, when in this case it was the lure itself.
Denmark as headline context
On October 5, 2026, Denmark's government disclosed unauthorized access to personal data of about 8.8 million people in Denmark's national population register, the CPR register. The compromised information includes names, addresses, and CPR numbers — Denmark's national ID numbers.
That disclosure is headline context for this briefing, and it is used only that way here. This article does not claim scammers are actively exploiting the Denmark breach, and no source used here documents that. The full background is in the briefing "Denmark CPR Registry Breach: About 8.8 Million Records Exposed".
The point of naming Denmark is timing, not a new threat claim. When a breach this large is in the news, expect tactics to be updated to match the headline, whoever it is about.
Do not use the contact info in the message
If you suspect a phishing attack and you do have an account with the company named, the FTC advises contacting the company through a phone number or website you already know is real, rather than using the contact information in the email.
Do not click the links in the alert, and do not use a phone number, website, or reply address supplied by that same message to check whether it is real. Links and attachments might install harmful malware — another reason to go around the message instead of through it.
Type the company's address yourself, or use a number you already know. If the alert was real, the company can still help you that way.
Report the fake
The FTC gives three reporting routes:
- Forward a phishing text message to SPAM (7726).
- Forward a phishing email to the Anti-Phishing Working Group at reportphishing@apwg.org.
- Report the phishing attempt to the FTC at ReportFraud.ftc.gov.
Use the route that matches how the message reached you.
A breach headline will fade in a few days. The habit should not: pause, ignore the contact details inside any urgent alert, verify through a number or website you know is real, and report the fake.
Sources: FTC — Scammers follow the headlines ↗ · FTC — How to Recognize and Avoid Phishing Scams ↗ · Illinois Emergency Management Agency — Protect Yourself! Don't Take the Bait on Phishing Scams! ↗ · Help Net Security — Denmark CPR data breach ↗