Originally published on the Dunime blog.
How an investigator separates a real disclosure from recycled data, and what an organisation should do in the first hours.
A breach is announced on X. Screenshots spread. Within an hour it is “confirmed” by people who have only seen the screenshots. Most of the time, nobody has checked anything yet.
What a breach claim usually is
Claims surface on social media, Telegram channels and forums, often with a sample and a record count. Some are real. Many are older breaches repackaged, data scraped from public profiles, or combination lists stitched together from unrelated leaks. The claim is a lead. It is not yet a fact.
Question 1: who is the source?
A new account with no history, or a seller who profits from attention, is a lead to follow up, not a confirmation. Look at what the same source has claimed before and how much of it held up.
Question 2: do the numbers agree?
Real disclosures are usually internally consistent: the record count, the fields described and the dates line up. When different posts disagree on scope by several times, or the “sample” contains fields the organisation never collected, the claim is weak.
Do not download the sample. Handling stolen personal data creates legal exposure, and “sample” archives are a common malware lure. Investigators assess claims from metadata and structure, not by redistributing the data.
Question 3: who has verified it?
Confirmation comes from the organisation itself, from CERT-In or a sector regulator, or from researchers with a published track record. Until one of them speaks, write and share it as an allegation.
Any answer is no? It is an allegation. Protect yourself, do not amplify it, and never open the sample.
If you might be affected
- Check your email on Have I Been Pwned, a free service that tells you which known breaches include your address. Its limit: it only knows breaches that have been loaded into it.
- Change reused passwords starting with email and banking, and turn on two-factor authentication.
- Expect targeted phishing that quotes the breach. That is often the real damage.
If your organisation is named
Preserve logs before anything is rotated or overwritten, and investigate quietly before confirming or denying in public; a premature denial that later proves wrong costs more than a holding statement.
Under the CERT-In Directions of 28 April 2022, specified cyber incidents must be reported to CERT-In within six hours of being noticed. Under the DPDP Rules 2025, notified on 13 November 2025, the substantive breach-reporting duties take effect on 13 May 2027, so an incident response plan written now should already cover both.
Questions people ask
How do I know if a data breach claim is real? Ask three questions: who is the source and what is their track record, do the numbers and fields in the claim agree with each other, and has the organisation, CERT-In, a regulator or a credible researcher verified it. If not, treat it as an allegation.
Should I download a leaked data sample to check it? No. Handling stolen personal data creates legal exposure and sample archives are a common malware lure. Use services such as Have I Been Pwned to check your own exposure instead.
How quickly must a cyber incident be reported to CERT-In? Under the CERT-In Directions of 28 April 2022, specified cyber incidents must be reported within six hours of being noticed.
Sources
This guide is part of Dunime's fraud-help hub — also in हिन्दी, বাংলা, मराठी, తెలుగు and தமிழ், each with a short video: dunime.com/protect.
Want to know if your data is in a real breach? Dunime's VAPT and exposure checks show what's actually reachable. Talk to us.
Published by Dunime Technologies — custom software, automation and cybersecurity, Delhi NCR, India.