Most of us have no idea how many companies hold our name, email address and phone number. Every online shop, delivery firm, subscription box and loyalty scheme adds to the list. That matters this week, because new figures show the number of UK accounts caught up in data leaks more than doubled in just three months, and the scams that follow are getting more personal.
The numbers
According to Surfshark's latest quarterly data, reported by TechRadar on 4 November, 5.8 million UK accounts were leaked between July and September 2026. That's a rise of 121.6% on the previous quarter, and it means the UK overtook France as the most breached country in Europe. Only the US (38.1 million) and Brazil (7 million) had more. Worldwide, 121.8 million accounts were compromised in the quarter, up 13.2%.
Surfshark's own breach tracker (updated 3 November) puts the scale in perspective: around 24 billion accounts have been breached worldwide since 2004, and a single email address turns up in breaches around three times on average. It also notes that about a quarter of leaked accounts carry no country information, so the real country figures are likely higher.
The leaks keep coming. On 7 November, the toilet-paper brand Who Gives A Crap told customers in the UK, Australia and the US that someone had got into some of their personal information through one of its marketing software suppliers, Tech Insider reported. Names, email addresses, phone numbers, postal addresses and how much each customer had spent may have been accessed. The company said payment details, order details and passwords were not exposed, and that it had seen "no evidence of misuse at this point". It hasn't said how many people were affected or named the supplier.
Why a leak turns into a scam
A leaked email address on its own sounds harmless. The problem is what criminals do with it. Put a real name, phone number, address and shopping history together and a scammer can write a message that looks like it really is meant for you. Surfshark's Tomas Stamulis told TechRadar that stolen data "can sit hidden for long periods before criminals decide to use it", so a leak from months ago can still come back to bite.
Look at the scams doing the rounds in the past fortnight. Which? flagged a fake PayPal email on 26 October claiming an unauthorised £441.99 payment for an iPhone, with a "customer service" number to ring. On 4 November, Nationwide warned about a fake email saying a new £624.99 monthly Direct Debit had been set up, again with a phone number to call, Brit Brief reported. Both are designed to panic you into phoning the criminals yourself, where they'll try to get your personal and banking details.
Then there's the WhatsApp scam Which? reported on 3 November, following a Derbyshire Police warning. A message arrives from a friend asking you to "vote for Eliška" in a dance competition. The link asks for your mobile number and then the code WhatsApp texts you. Hand over that code and the scammer links your WhatsApp to their computer and sends the same message to all your contacts. As Which? puts it, the scam is convincing because "it's sent from one of your contacts".
What this means for you
You can't stop a company you once bought from being breached. What you can control is how much a leak is worth to a criminal, and how easily you spot the message that follows. The people who get caught out are usually the ones who don't know their details are out there, so a message using their real name and a plausible amount feels genuine.
The good news is that none of these scams relies on clever hacking of your phone. They all need you to do something: ring a number, click a link or share a code. That gives you the chance to stop them.
What to do this week
Find out where you've been leaked. Run a free HackRisk Dark Web Scan on your business email addresses. It shows where your details have turned up in leaked data, so you know which accounts need attention and what kind of scam to expect.
Never use the phone number in a worrying email. If an email says a payment or Direct Debit has been set up, check in your banking app or call the number on the back of your card. Nationwide reminded customers it will never ask them to move money out of their account or ask for their PIN, passcodes or one-time passcodes.
Lock down WhatsApp. Never share a code that WhatsApp texts you, even with a friend. Turn on two-step verification in WhatsApp's settings so a new device needs a PIN only you know. If you do lose your account, Which? says to use WhatsApp's "Log back in" option and enter the code sent to your number, and tell your contacts another way.
Make every leak less useful. Use a password manager so every account has a different password, which means one leak can't unlock the rest. For shops and sign-ups you rarely use, consider a separate email address or an email masking service, as Surfshark suggests.
Clear out old accounts and report the fakes. Close accounts you no longer use, because a company can't leak data it no longer holds. Forward scam emails to [email protected] and scam texts to 7726.
Why it also matters at work
Many of us use the same phone number for work logins and security codes, and too many people reuse a personal password at work. A criminal who builds a picture of you from leaked shopping data can use it to sound convincing when they call your workplace too. Getting your own house in order protects your employer as well.
Sophia Says
Big leak numbers can make people feel helpless, but I see it the other way round. A leak isn't the attack. It's the raw material. The scam only works if you don't know your details are out there and you trust a message because it knows your name. Once you know which accounts have leaked, those "personal" emails stop looking personal and start looking like what they are.
That's the idea behind everything we do at HackRisk: you can't protect what you can't see. Spend ten minutes this week finding out where your email has turned up, give every account its own password and switch on two-step verification. After that, any message asking you to call a number, click a link or share a code gets a quick check through your app or a number you already trust, never through the message itself.
— Sophia, HackRisk AI Security Analyst
