Security × Privacy

Breach.

Not cyber theater. The stuff ordinary people can actually check, understand, and change.

New to this? Tap any highlighted tech term for the plain-English version, or visit Tech / Explain it simple →

Defense, not a playbook.

We explain attack paths far enough to protect yourself, not far enough to help somebody compromise another person.

Something feels off

Does your phone feel like your phone?

Battery drain, heat, or extra data use can have innocent explanations. The stronger signal is a pattern: somebody knows private details they should not know, your sharing settings changed, unfamiliar apps or devices appear, or permissions do not match what you remember granting.

iPhone: run Safety Check

Apple built-in

On iOS 16 or later: Settings → Privacy & Security → Safety Check. Review who has access to your information, connected devices, app privacy permissions, and account security. Emergency Reset can stop sharing quickly.

Apple Safety Check guide →

Android: run Play Protect

Google built-in

Open the Play Store, tap your profile, then Play Protect. Google says Play Protect scans installed apps for harmful behavior and can warn, disable, or remove potentially harmful apps.

Google Play Protect guide →

If this may involve an abusive partner or ex

Do not assume deleting an app or changing settings is the safest first move. Removing monitoring can alert the person doing it. The FTC recommends using another trusted device to seek help and thinking about safety planning before changing the monitored phone.

FTC stalkerware guidance →

Phone Watch stories

Your Phone Can Be Spied On Twice Stalkerware can expose what is on a phone, while the companies collecting that data can become breach targets themselves. mSpy is a useful case study in both risks.

Account Takeover

Start with the account that resets the others.

For most people, that is email. Social accounts, shopping, banking alerts, cloud storage, and password resets often point back to it.

Words you may see here

A is different from your password. adds another check. A targets your phone number.

First 15 minutes

Use a trusted device

If you think the original device is compromised, make account changes from another device you trust.

Secure email first

Change the email password if needed, review recovery methods, and remove sessions you do not recognize.

Kill unknown sessions

Sign out unfamiliar browsers, phones, apps, and sessions on the affected service.

Fix the recovery path

Check recovery email addresses, phone numbers, backup codes, and connected apps.

Upgrade authentication

Add a passkey or strong MFA. Do not approve login prompts you did not initiate.

Check your carrier

If your phone suddenly loses service or you suspect a SIM swap, contact the carrier from a known number and lock the account down.

Review Google devices → Google passkeys →

Account takeover stories

Your Password Is Not the Whole Login Session theft can let malware steal an already-authenticated browser session, which is why account security has to include devices and active sessions, not just passwords. The Scam Where the Victim Does the Installing ClickFix attacks disguise malicious instructions as CAPTCHAs or troubleshooting steps and persuade victims to run the attack themselves. X Money Made Old Accounts More Interesting to Attackers After X Money launched, users reported waves of unsolicited password-reset emails. X said it was investigating and had not found evidence of a platform breach. Instagram Accounts Were Hijacked by Asking the Help Bot Nicely A 2026 Instagram takeover incident showed that account recovery itself can become the weak link when identity checks fail.

Data Breaches

The headline is not the risk assessment.

A is not one single kind of event. “Millions exposed” tells you almost nothing by itself. What matters is what data escaped and what somebody can do with it.

Passwords / hashes

Change reused credentials. If the same password exists elsewhere, those accounts matter too.

Session tokens

A stolen session can matter even when the password is still secret. Review active sessions and revoke them.

Identity documents

Passports, licenses, selfies, and tax identifiers can support impersonation and identity fraud.

Email + phone

Expect more convincing phishing, fake support calls, recovery attempts, and SIM-swap social engineering.

Financial data

Watch the affected accounts, enable alerts, and follow the institution’s breach-specific guidance.

Private messages / files

The risk may be reputational, personal, workplace-related, or safety-related — not just financial.

Current Breach files

A Real Government Email Domain Can Still Carry a Fake Request Revolut said it disclosed customer information after fraudulent requests arrived through a legitimate government-agency email domain. Your Phone Can Be Spied On Twice Stalkerware can expose what is on a phone, while the companies collecting that data can become breach targets themselves. mSpy is a useful case study in both risks.

Lock It Down

Do the boring stuff before you need it.

This checklist stays in your browser. Check things off as you harden your setup. A is one of the stronger upgrades you may see recommended below.

Progress

0 / 8

Install phone, browser, and app updates Old software leaves known holes open longer than necessary. Use passkeys where your important accounts support them Passkeys are resistant to many common phishing attacks. Turn on strong MFA everywhere else Prefer security keys or authenticator-based options over SMS when available. Review active sessions and signed-in devices Remove devices and sessions you do not recognize or no longer use. Audit recovery email addresses and phone numbers Old recovery methods can become a side door back into the account. Protect your carrier account Use the carrier PIN or number-transfer protection your provider offers. Stop reusing passwords Use a password manager for accounts that still require passwords. Review connected apps and account permissions Remove integrations you no longer use or do not remember approving.

Apple

Use passkeys on iPhone →

CISA

Mobile security practices →