A Data Breach Rarely Ends with the Breach Itself – Leaked Data Is Used in Travel and Ticket Scams During the Summer

According to Heidi Havastila, Head of Value-Added Services at DNA, a data breach should not be viewed as an isolated incident, as criminals often continue to exploit leaked data long after the original breach has occurred.

“A data breach rarely ends with the breach itself. Leaked information is often used later in targeted phishing attempts, account takeovers and identity theft. As a result, victims may remain targets of criminal activity long after the initial breach,” Havastila says.

During the summer, scammers particularly exploit situations where people are booking accommodation, purchasing event tickets or waiting for online orders to arrive. A phishing message may appear to come from a delivery company, ticketing service or accommodation provider and seem genuine precisely because the recipient is expecting communication related to that service.

“When people are waiting for festival tickets, a parcel delivery or an upcoming holiday, they may not scrutinize a message as carefully as they normally would. Criminals deliberately design their scams around these situations,” Havastila notes.

Cybersecurity Starts Before a Data Breach Occurs

Although data breaches cannot be prevented entirely, individuals can significantly reduce their risk through proactive measures. For example, when booking travel or shopping online, some personal information is necessary, but risks can be managed by choosing trusted services and ensuring account credentials are properly protected.

“Cybersecurity begins with everyday choices. Especially when using new or less familiar services, it is worth considering whether the information being requested is justified. Only essential information should be shared, and particular caution should be exercised when providing personal identity numbers or banking details,” Havastila advises.

Summer also brings another often-overlooked aspect of cybersecurity: protecting your devices. In crowded events, while travelling or at outdoor cafés, a phone can be lost or fall into the wrong hands in an instant. If someone simultaneously learns the device’s passcode, the consequences can be far more serious than the value of the device itself.

“When entering a PIN code or other unlock code, always shield the keypad from view. Consider what a scammer could do if they gained access to your phone and also knew the code required to unlock it. In addition to the device itself, your email account, social media profiles, payment cards and online banking services could all be at risk,” Havastila reminds.

One Leaked Password Can Open the Door to Multiple Services

The impact of a data breach can multiply if the same password is used across multiple services.

“One of the most common risks remains password reuse. If the same password is used for several services, the consequences of a single data leak can quickly spread to many other accounts,” Havastila says.

Every service should have its own unique password, and two-factor authentication should always be enabled whenever possible.

“If a service offers two-factor authentication, it should be enabled. It is one of the most effective ways to prevent account takeovers,” Havastila adds. 

If Your Data Is Leaked, Act Quickly

If a service you use reports a data breach, or if you suspect that your information has fallen into the wrong hands, a swift response can help prevent further damage.

If you believe you have entered your online banking credentials on a fraudulent website, your first step should be to contact your bank immediately. Otherwise, the first action should be to change the password for the affected service as well as for any other services where the same password has been used. Next, enable two-factor authentication, review account activity and payment cards for suspicious transactions, and log out of all active sessions across devices.

Following a data leak, it is important to treat emails and text messages requesting that you log in or verify information via a link with particular caution.

“After a data leak, you may receive phishing attempts by email or text message that appear more convincing than usual. Rather than clicking links in messages, it is safer to access services by typing the address directly into your browser or by using the official app,” Havastila advises.

The Suomi.fi service provides a guide for Finnish residents on what to do in the event of a data leak at: www.suomi.fi/guides/data-leak

“Data breaches are no longer exceptions, they are part of everyday digital life. The best protection comes from preparation. The less information that has been shared, the better accounts are protected, and the faster people react, the more limited the damage will be,” Havastila concludes.

Media Inquiries:

DNA Corporate Communications, tel. +358 44 044 8000, communications@dna.fi