The Breach After the Breach.

When we hear about a major data breach, most of the attention naturally goes to the incident itself.

What was stolen? How many people were affected? Was a ransom paid? Has the system been restored?

But an article I recently read in Cyber Magazine raised another risk that I think deserves more attention: the second wave.

Manchester Airports Group recently disclosed a cyberattack affecting approximately 8.7 million customers. According to the article, compromised information included email addresses, phone numbers, vehicle registrations and postcodes. Cybersecurity experts warned that this information could become valuable well after the initial breach.

That is what caught my attention.

Stolen information can create credibility.

The information stolen in a breach does not have to include banking credentials to create financial risk.

It can give criminals something almost as useful: credibility.

Imagine receiving a text about an airport parking fee. The message includes your vehicle registration. Maybe it references an airport you have actually used. The amount being requested is small enough that paying it seems easier than questioning it.

Those accurate details can lower our defenses.

Now add AI.

AI gives bad actors the ability to take compromised information and quickly create personalized, polished and believable communications at scale. The Cyber Magazine article specifically warns that stolen customer information can be used to make phishing emails and text messages much more convincing.

And the attack does not necessarily happen tomorrow.

One of the most important observations in the article was the idea of breach fatigue. Criminals can sit on stolen information for months, allow the headlines and customer warnings to disappear, and then attempt an attack when people are no longer thinking about the original breach.

That makes this a resilience issue.

Not because consumers should somehow be expected to recognize every sophisticated scam. In fact, that expectation is becoming increasingly unrealistic.

Instead, we may need to change what we consider evidence of trust.

A message knowing your name is not proof that it is legitimate.

Knowing your phone number is not proof.

Knowing where you traveled, what vehicle you drive, where you live or some other piece of accurate personal information is not proof either.

The habit we need to build is verification.

If an unexpected communication asks for payment, login credentials or additional personal information:

• Avoid using the link or phone number contained in the message.
• Go directly to the company's website or mobile application.
• Contact the organization through a phone number or communication channel you independently know to be legitimate.
• Be cautious when a message creates urgency or pressure to act immediately.
• Use multi-factor authentication on important accounts so a stolen password alone is less useful.
• If something feels unusual, verify it before providing additional information.

That last point is important. The Federal Trade Commission similarly recommends contacting a company through a phone number or website you already know is legitimate rather than relying on contact information contained in an unexpected message. The FTC also recommends two-factor authentication as another layer of protection.

Consumer resilience is only half of the equation.

Organizations that collect our information also have a responsibility that extends beyond sending a breach notification.

If customer information has been exposed, companies should be thinking about what criminals could do with that information next. That means helping customers understand the kinds of impersonation attempts they may see, communicating for longer than the immediate news cycle and preparing for secondary phishing and fraud attempts.

Cyber resilience has to become a shared responsibility.

Organizations must continue improving how they protect the information entrusted to them.

Consumers, meanwhile, need habits that recognize a difficult new reality:

Sometimes the information that makes a message look legitimate is exactly what was stolen.

That may be one of the most important lessons from the second wave of cyber risk.

Source article: Cyber Magazine — “Three UK Airports Face Cyberattack: Experts Have Their Say” (August 28, 2026). Consumer guidance: Federal Trade Commission — “Protect yourself from phishing scams”.