Family members' names leaked: what it means and what to do
Risk level: medium. Can you change it: no. Found in 5 breaches in this directory.
What this data is
Names of your partner, children, parents, siblings or other relatives, stored as emergency contacts, beneficiaries, household members, family tree entries or authorised users on an account.
The risk on its own
A list of relatives' names does not open accounts by itself. It does answer some of the most common security questions, and it tells a stranger who you care about. Children's names are especially sensitive because they help build records about minors.
The risk combined with other data
With your phone number and address it becomes the script for family emergency scams: a call or message that names your real grandchild or son and says they are in trouble. It helps impersonators convince support desks they are you, and it exposes relatives who never dealt with the company. If a mother's maiden name can be worked out from the list, one of the oldest identity checks is gone too.
How criminals use it
A grandparent gets a call from someone using their grandchild's real name, claiming an arrest and asking for bail money.
A text from an unknown number says hi Mum, I lost my phone, signs off with your child's name and asks for money for a bill.
An attacker answers a security question about your oldest sibling or your first child to reset an account.
Relatives listed as emergency contacts receive phishing that mentions you by name.
What to do now
Agree a family code word for any urgent request for money, and use it before anyone pays anything.
Tell older relatives about family emergency scams directly: hang up and call the family member back on the number they already have.
Change security question answers based on relatives' names, or replace them with random answers stored in a password manager.
Hide family members and relationship details on Facebook and other social profiles.
Ask the breached company which relatives' details were exposed, and let those relatives know.
Frequently asked questions
Should I tell my relatives their names leaked?
Yes, especially older relatives and anyone listed as an emergency contact, because they are the people scammers will call.
What is a hi Mum scam?
A message from an unknown number claiming to be your child on a new phone, followed by an urgent request to pay a bill. Call your child on their usual number before doing anything.
Can someone reset my accounts with my family's names?
Only where security questions rely on them. Replace those answers with random ones and use two-factor authentication so a correct answer is never enough.
Breaches that exposed this data
VTech: 2015-11-13, 4.8M accounts, Dates of birth, Email addresses, Family members' names, Genders, IP addresses, Names
CloudPets: 2017-01-01, 584K accounts, Email addresses, Family members' names, Passwords
COMELEC (Philippines Voters): 2016-03-27, 229K accounts, Biometric data, Dates of birth, Email addresses, Family members' names, Genders, Job titles
Upstox: 2021-04-08, 111K accounts, Bank account numbers, Dates of birth, Email addresses, Family members' names, Genders, Government issued IDs
Jobzone: 2023-04-15, 30K accounts, Dates of birth, Email addresses, Family members' names, Genders, Government issued IDs, Names
Breach data sourced from Have I Been Pwned, used under CC BY 4.0. Additional breach metadata provided by XposedOrNot. DataExposed is an independent service and is not affiliated with or endorsed by either.