Was Your Data Leaked in a Breach? How to Check and What to Do in Colombia

Most people whose personal data ends up circulating in a security breach don't find out from the responsible company — they find out months later, when they start receiving surprisingly specific phishing attempts, or when someone tries to access one of their accounts using a password they'd only ever used on a service they'd forgotten they used. Reported data breaches have grown rapidly in recent years, with millions of email records exposed in just the latest reported period — and most affected people still don't know it.

A leaked email on its own seems minor, but it rarely travels alone. Data breaches usually expose combinations of information — email, password (sometimes in plain text, sometimes hashed but potentially crackable), phone number, address — that together give an attacker enough material for targeted phishing attempts far more convincing than a generic email, or for direct access attempts on other accounts where the victim reused the same password.

Specialized, free services exist that let you enter an email address to check whether it appears in known, publicly documented breach databases. These services don't access your accounts or require passwords — they simply compare your email address against already-reported and cataloged breach records. It's worth checking periodically, not just once, since new breaches get documented continuously.

Immediately change the password for the affected service, and for any other service where you reused the same password — this is exactly the risk password reuse amplifies.

Enable multi-factor authentication on any important account that doesn't already have it, prioritizing authenticator apps over SMS when possible.

Closely monitor your financial accounts over the following weeks, paying special attention to access attempts or transactions you don't recognize.

Prepare for an increase in targeted phishing attempts, since leaked data is often used specifically to make those emails more convincing — check our guide on how to spot a phishing email if you notice an unusual increase in suspicious messages.

If your business was the source of the leak — meaning your customers' or employees' data was what got exposed — the obligations go far beyond recommending good practices to those affected. Colombia's Habeas Data Law requires reporting the incident to the Superintendency of Industry and Commerce when personal data is compromised, and our guide on when reporting a cyberattack is legally required details exactly those timelines and processes.

Most of the real damage a data breach causes doesn't come from the leak itself, but from password reuse across services. If your password for a forum you stopped using years ago is the same one you use for your main email, a breach at that forum gives an attacker potential access to your email — and from there, to practically everything else through password recovery. A password manager that generates unique credentials for each service eliminates this risk at the root.