Support tickets leaked: what it means and what to do

What this data is

Messages, chat transcripts, attachments and notes from customer support conversations, including problems you reported and details you shared to prove who you are.

The risk on its own

Support tickets are unpredictable, and that is the danger. People attach photos of passports, driver licences and bank statements, share screenshots with account details and describe security problems. Agent notes can also reveal how the company verified you.

The risk combined with other data

With your email address and account ID, ticket data gives attackers a script for social engineering. They can refer to your real support case, repeat details you gave, and ask support to reset access. Attached ID documents may also enable identity fraud.

How criminals use it

• A fake support email references your real ticket number and asks you to log in through a phishing link.
• An attacker calls support, quotes details from an old ticket and gets your email address changed.
• An ID document attached to a ticket is used to open an account in your name.
• Screenshots in a ticket reveal account numbers, order details or partial passwords.

What to do now

1. Review past support tickets with that company and note whether you shared ID documents, bank details or passwords.
2. If ID documents were attached, follow the steps for those documents, including a credit freeze where relevant.
3. Change the account password and any password you ever shared with support.
4. Ask the company to add an account note that no changes should be made without strong verification.
5. Treat emails about support cases as unverified and access the help centre directly.

Frequently asked questions

Why are support tickets sensitive?

People often share ID, account details and screenshots when asking for help, so tickets can contain far more than profile data.

I sent a photo of my ID to support. What should I do?

Treat that document as exposed. Consider a credit freeze and contact the issuing authority if the number can be replaced.

Should support ever ask for my password?

No. Genuine support teams should not need your password. Change it immediately if you shared it.

Breaches that exposed this data

• Hathway: 2023-12-17, 4.7M accounts, Device information, Email addresses, IP addresses, Names, Passwords, Phone numbers
• Amtrak: 2026-04-03, 2.1M accounts, Email addresses, Names, Physical addresses, Support tickets
• Hallmark: 2026-03-31, 1.7M accounts, Email addresses, Names, Phone numbers, Physical addresses, Support tickets
• Questel: 2026-08-01, 1.2M accounts, Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses
• Fluke: 2026-07-01, 821K accounts, Email addresses, Employers, Job titles, Names, Physical addresses, Support tickets
• Medela: 2026-09-07, 424K accounts, Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses
• BCD Travel: 2026-05-29, 396K accounts, Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses
• CyrusOne: 2026-08-05, 373K accounts, Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses
• Canada Life: 2026-04-20, 238K accounts, Email addresses, Job titles, Names, Phone numbers, Physical addresses, Salutations
• Samsung Germany Customer Tickets: 2025-03-30, 216K accounts, Email addresses, Names, Physical addresses, Purchases, Salutations, Shipment tracking numbers
• Zara: 2026-04-15, 197K accounts, Email addresses, Geographic locations, Purchases, Support tickets
• Infinite Campus: 2026-03-18, 137K accounts, Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses

Tools that help

• Email Breach Check
• Phishing Link Checker
• Email Header Analyzer

Related guides

• Phishing Email Received? What to Do in the Next 15 Minutes
• Identity Theft Checklist: What to Do in the First 48 Hours
• Credit Freeze Guide: US, Australia, UK and Canada Steps
• What to Do After a Breach: Your Hour, Day and Month Plan