Customer interactions leaked: what it means and what to do
Risk level: medium. Can you change it: no. Found in 1 breaches in this directory.
What this data is
A company's log of your contact with it: dates of calls, chats and emails, the channel you used, what each contact was about, and sometimes marketing email clicks and store visits.
The risk on its own
The log shows your relationship with a business in detail: when you last spoke to them, about what, and whether a problem is still open. It cannot open your account on its own. It gives anyone reading it the context to pretend to be that company.
The risk combined with other data
With your name, phone number and account number, it is an impersonation script. A caller who mentions your chat last week about a delayed order sounds exactly like the company's own staff. It also shows which channels you respond to, so the scam arrives on the one you actually use.
How criminals use it
A caller follows up your real open support case and asks you to confirm your card details to finish the fix.
A text mentions your recent order or store visit and links to a fake account login page.
An attacker learns which contact channel the company uses to verify you and targets that channel first.
A fraudster contacts the company as you, quoting your recent interactions to pass its checks.
What to do now
Treat any unexpected follow up on a past conversation as unverified, and contact the company yourself through its app, website or the number on your bill.
Ask the company to add a password or PIN to your account, so callers must provide something that was not in the breach.
Change the account password and turn on two-factor authentication.
Ask what the interaction records contained, especially whether call recordings or chat transcripts were included.
Opt out of marketing tracking in the account privacy settings to reduce future interaction data.
Frequently asked questions
How could a scammer know about my recent call with a company?
From leaked interaction records like these. Knowing the detail does not make the caller genuine, so hang up and call the company back yourself.
Is this as serious as a password leak?
No, it cannot open the account. It makes impersonation far more convincing, which is how many account takeovers begin.
Can I ask for my contact history to be deleted?
You can ask. Companies may keep some records for legal or complaint handling reasons, but in many places they must delete marketing and tracking history on request.
Breaches that exposed this data
StarNet: 2015-02-26, 139K accounts, Customer interactions, Dates of birth, Email addresses, Genders, IP addresses, MAC addresses
Breach data sourced from Have I Been Pwned, used under CC BY 4.0. Additional breach metadata provided by XposedOrNot. DataExposed is an independent service and is not affiliated with or endorsed by either.