A new report from a consumer watchdog group suggests that a huge chunk of those "we've been breached, here's free identity protection" emails flooding inboxes this year are themselves phishing attempts dressed up as corporate apologies.
The group analyzed roughly 4,200 breach notifications sent to US consumers over the past eighteen months and found that nearly one in three contained links that didn't resolve to the company that supposedly got hacked.
In a follow-up survey, 61% of respondents admitted they opened at least one suspicious breach email in the last year, because at this point, who even keeps track of which corporation leaked their Social Security number this week.
Between telecoms, insurance portals, and that one app you downloaded in 2019 to track your dog's steps, Americans have been notified of so many breaches that the alerts have basically become background noise.
The report notes that the average respondent received eleven breach notifications since January 2024, which is roughly one every six weeks.
Security researchers say scammers are exploiting that fatigue with alarming precision.
A fake breach email is weirdly effective because it arrives at a moment when you're already primed to believe your data is floating around somewhere.
It name-drops a real company, uses the same bland corporate font as the real thing, and offers a "secure portal" that's just a login form harvesting whatever you type into it.
The report found that these copycat campaigns spike within 72 hours of a legitimate breach making headlines.
Consumer advocates are pushing for a simpler fix: companies should stop putting links in breach notices entirely and instead direct people to log in through the company's own app or website.
A few states are reportedly exploring legislation, though given how fast Congress moves on tech issues, your grandkids might see that bill pass.
In the meantime, the practical advice hasn't changed much.
If you get a breach notice, don't click anything in it.
Go to the company's website yourself, log in, and check whether the notice is real.
And if someone offers you free credit monitoring through a link in an email, treat it the way you'd treat a gas station sushi platter.
The bigger takeaway here is that we've built a system where companies lose your data, apologize with a press release, and then hand you a coupon for a service you didn't ask for, while actual criminals ride in on the chaos.
Final Thoughts
Until breach notifications get standardized and link-free, the scammers will keep winning the game nobody signed up to play.