Mothers maiden names leaked: what it means and what to do
Risk level: high. Can you change it: no. Found in 1 breaches in this directory.
What this data is
Your mother's surname before marriage, collected by banks, insurers, phone carriers and older websites as a security question or identity check.
The risk on its own
The name harms nobody by itself, but it was stored as a secret and now it is not one. Any account that still accepts it as proof of identity can be reset or talked open by whoever reads the leak. It was never a strong secret anyway, since family trees, obituaries and social media often reveal it.
The risk combined with other data
Beside your name, date of birth and address it completes the classic telephone identity check. That combination lets a caller pass as you with a bank, a phone carrier or a utility, then change the contact details or order a replacement card. It also gives scammers family detail that makes impersonation calls sound researched.
How criminals use it
A caller passes your bank's phone check with your date of birth and mother's maiden name, then orders a new card to a different address.
Your mobile carrier is persuaded to move your number to a new SIM, handing the attacker every SMS code you receive.
An old email or shopping account that uses the question for password resets is taken over through the forgot password link.
A scammer posing as a solicitor handling a relative's estate uses the family surname to sound legitimate.
What to do now
List every account that ever asked for your mother's maiden name, starting with banks, pension funds, insurers and your mobile carrier.
Replace the answer on each with a random phrase saved in your password manager. The answer does not have to be true, only recorded.
Ask your bank and phone carrier to add a verbal password or account PIN so a maiden name alone no longer passes their checks.
Set a port out lock or number transfer PIN on your mobile account.
Remove family tree posts and social media details that name your mother's family.
Consider a credit freeze if your date of birth or address leaked in the same breach.
Frequently asked questions
Can I change my mother's maiden name answer?
The fact cannot change, but the answer you give can. Most services accept any text, so use a random answer kept in a password manager.
Do banks still use this question?
Some still use it as one of several phone checks, especially on older accounts. Ask yours directly and request a stronger method such as a verbal password.
It is already on a family tree website. Does the leak matter?
It confirms the answer against your account. Remove what you can online, but the real fix is to stop using it as a security answer anywhere.
Breaches that exposed this data
Kreditplus: 2020-06-23, 769K accounts, Dates of birth, Email addresses, Employers, Family structure, Genders, Income levels
Breach data sourced from Have I Been Pwned, used under CC BY 4.0. Additional breach metadata provided by XposedOrNot. DataExposed is an independent service and is not affiliated with or endorsed by either.