The breach is the setup. The phishing email is the punch. I run AliasFleet, an email-alias service: one forwarding address per site, so a leaked address names its source. Once your address is in a breach dump, the mail stops guessing. The sender holds your name, the company you trust, and the timing of that company's real warning notice, which means reading the message will not expose the forgery. Only the channel can.
When the mail starts knowing your name
Your name, spelled correctly, and your phone number under it. A shop you ordered from last year. Nothing in the message surprises you, and that is precisely why it works. Before the leak, the lures were anonymous: a parcel you never ordered, a prize you never won. The senders had to build trust from nothing, which made them easy to spot.
Then the timing gets precise. A breached company emails its customers: we are sorry, this is what happened, this is what to do. The attackers know the notice is coming because the breach is public, so the forged version lands in the same window, quoting the same apology. The content is not suspicious. It is the content you were told to expect.
Finally, the guessing stops. The old fake bank email had to ask which bank you used; the bank's own customer file answered that for the attacker, so the lure now states instead of asking. The mail is no longer trying to trick someone. It is trying to trick you, with your own file in hand.
| Before the leak | After the leak | |
|---|---|---|
| Personalisation | Your name is missing or wrong | Your name, address and phone read back correctly |
| Timing | Random, scattershot | Lands beside the company's real breach notice |
| Relationship | Guesses which services you use | Knows exactly which company you signed up with |
That last row breaks every old tip. "Check the sender" and "look for spelling mistakes" assumed an attacker working blind. The one holding the customer file is not blind: they have the template, the branding, the timing. When content is indistinguishable, content cannot be the test. The channel has to be.
The breach notice becomes the weapon
Lawson had to email 2.155 million people individually after attackers reached its member systems. Picture the real notice and the forged twin going out side by side, quoting the same apology and linking to different pages. That is what the Lawson breach analysis warned about. No reader separates those two by reading.
This is not one company's problem. It is the mechanics of every large breach that exposes email addresses: the notice has to exist, and the forgery rides along. So here is the one piece of advice that survives contact with a real breach. Never click the link in a breach email, even the one that looks real: open the app or type the address yourself. If the message is not there, it was not from them.
The punch is moving off email
The industry data says the attack is moving while this happens. The APWG's Q3 2025 report counted 892,494 phishing attacks in a single quarter, with SMS fraud detections up about 35 percent on the previous one. The 2026 Verizon Data Breach Investigations Report found phishing was the initial access vector for 16 percent of breaches, email remains the most common social-engineering vector at 98 percent, and users were 40 percent more likely to fall for mobile-based lures than email lures in simulations. A breakdown of the DBIR figures lays the mobile picture out plainly.
Then the escalation. Fortra's research arm, FIRE, reported on October 8 that phishing attacks incorporating remote monitoring and management tools rose 475 percent in the first nine months of 2026 compared with the entire previous year, targeting North American financial institutions and commercial banking accounts. The flow runs like this: a call, email or text warns of a bank account problem, the victim is steered to a fake bank site with a "live chat", and opening the chat starts a download of a remote access tool, most commonly AnyDesk. The attacker then asks for the connection key. The software is legitimate; the operator is not. Read the full Fortra report for the campaign detail.
Two caveats travel with that figure. Fortra is counting attacks it observed, not a global census of compromises or losses. And it compares January to September 2026 against the whole of 2025, so it is not a same-period year-over-year. The direction is real. The multiple is Fortra's view, not the world's.
The check no forgery can pass
The mechanics of the report and unsubscribe buttons were built for a sender you can identify. Post-breach phishing never wants to be identified: it wants to wear the name of the company you already trust. The event-driven brand impersonation we covered during Prime Big Deal Days was the amateur version, opportunistic lures aimed at everyone. Post-breach phishing is aimed at you by name, and against it one check still works, because it never reads the message.
Give every site a dedicated email alias and the To line becomes a lie detector. You sign up at a store with an address that exists only for that store, and the mail forwards to your real inbox. When the store's customer file leaks, the attackers hold one address that is only ever useful for mail about that store. A "breach notification" from the store on that alias is plausible. The same notification on your bank's alias is fake by definition. The content did not change. The channel exposed it.
This is the leak-tracing mechanism pointed at the phishing problem instead of the spam problem. The moment mail about Company X lands on an alias Company X never had, you learn which company leaked, that the message is forged, and exactly which channel to kill, all at once. Pause the alias and the whole impersonation lane dies while your real inbox keeps working. The set-up guide takes about two minutes.
Every "how to spot phishing" guide asks you to examine the message. Stop examining the message. Examine where it landed. Mail about a company on that company's alias gets read normally. Mail about that company anywhere else gets deleted without being opened. Two sentences, no exceptions, and no forged template can get around it because the attacker never had your alias.
What to do when it lands
Start at Have I Been Pwned. Type your address in. The results list every breach holding it and what each one took, which tells you what kind of problem you have. An email address alone means phishing. Passwords or ID numbers in the dump mean account takeover too, and the breach-response order of operations covers that in full.
Reply to nothing, click nothing, and do not call the number in the message. Google's advice on reporting phishing is More, then Report phishing, which sends Gmail a copy for analysis. Your address stays in the attacker's file regardless. Report anyway. Every report sharpens the filter for everyone behind you, which is reason enough to do it.
Next, the reused passwords. Your leaked email paired with a password from any older breach gets fed into credential-stuffing software that tries the combination everywhere while the attacker sleeps. Start with your email account, because every password reset flows through it, then the bank. A password manager makes this a twenty-minute job instead of a lost weekend.
If the mail arrives in volume, read the spam-spike diagnostic. Unsubscribing handles a sender. It does nothing against an attacker working a breach dump. Different problem, different fix, and the spam sourcing explainer covers where the addresses come from in the first place.
The part no tool touches
Here is the part no tool reaches: your address stays in the breach dump. Nothing takes it out. The alias check does not stop the phishing from being sent. It stops it from being believed, and after a breach that is the entire game, because the attacker only wins when the message is trusted, and trust is exactly what the channel test removes.
How long does the wave last? Honestly, I have not seen a number I would defend, so I am not quoting one.
The breach is the setup. It already happened, and there is no undoing it. The punch, the phishing wave that follows, is still in motion. So build the habit now: wrong alias, fake message, delete. No examination, no engagement, no exceptions. The next notice from the next company will look real, and the channel will tell you the truth anyway.
Top comments (2)
Good point that once the data is leaked the message itself can look perfect, so only the channel gives the forgery away. A separate address per site makes that easy to spot. Clear and practical read.
Thanks, that is exactly the point. Once the message looks perfect, the content stops being a useful signal. The only thing left is the channel: did it come to an address that only that one site knows? If it did not, it is not from them. Glad it landed.