A breach claim is trending. Ask three questions first

A breach is announced on X. Screenshots spread. Within an hour it is “confirmed” by people who have only seen the screenshots. Most of the time, nobody has checked anything yet.

What a breach claim usually is

Claims surface on social media, Telegram channels and forums, often with a sample and a record count. Some are real. Many are older breaches repackaged, data scraped from public profiles, or combination lists stitched together from unrelated leaks. The claim is a lead. It is not yet a fact.

Question 1: who is the source?

A new account with no history, or a seller who profits from attention, is a lead to follow up, not a confirmation. Look at what the same source has claimed before and how much of it held up.

Question 2: do the numbers agree?

Real disclosures are usually internally consistent: the record count, the fields described and the dates line up. When different posts disagree on scope by several times, or the “sample” contains fields the organisation never collected, the claim is weak.

Do not download the sample. Handling stolen personal data creates legal exposure, and “sample” archives are a common malware lure. Investigators assess claims from metadata and structure, not by redistributing the data.

Question 3: who has verified it?

Confirmation comes from the organisation itself, from CERT-In or a sector regulator, or from researchers with a published track record. Until one of them speaks, write and share it as an allegation.

Any answer is no? It is an allegation. Protect yourself, do not amplify it, and never open the sample.

If you might be affected

Check your email on Have I Been Pwned, a free service that tells you which known breaches include your address. Its limit: it only knows breaches that have been loaded into it.Change reused passwords starting with email and banking, and turn on two-factor authentication.Expect targeted phishing that quotes the breach. That is often the real damage.

If your organisation is named

Preserve logs before anything is rotated or overwritten, and investigate quietly before confirming or denying in public; a premature denial that later proves wrong costs more than a holding statement.

Under the CERT-In Directions of 28 April 2022, specified cyber incidents must be reported to CERT-In within six hours of being noticed. Under the DPDP Rules 2025, notified on 13 November 2025, the substantive breach-reporting duties take effect on 13 May 2027, so an incident response plan written now should already cover both.

Questions people ask

How do I know if a data breach claim is real? Ask three questions: who is the source and what is their track record, do the numbers and fields in the claim agree with each other, and has the organisation, CERT-In, a regulator or a credible researcher verified it. If not, treat it as an allegation.

Should I download a leaked data sample to check it? No. Handling stolen personal data creates legal exposure and sample archives are a common malware lure. Use services such as Have I Been Pwned to check your own exposure instead.

How quickly must a cyber incident be reported to CERT-In? Under the CERT-In Directions of 28 April 2022, specified cyber incidents must be reported within six hours of being noticed.

From DunimeIncident response planning and cyber audits, written around CERT-In's six-hour reporting rule.→