Your Phone Number Was in a Data Breach: What to Do Next

Data breaches happen to companies large and small, and phone numbers are often part of what gets exposed alongside emails, names, and account details. If you've received a breach notification, or you simply suspect your number is now circulating among data brokers and scammers, you can't undo the leak — but you can take steps to limit the fallout and make yourself a less attractive target going forward.

Why a leaked number matters

Once a phone number is exposed, it often ends up in lists that get bought, sold, and traded among marketers and criminals. Unlike a password, you can't simply change your number without real inconvenience, so a leaked number tends to keep generating spam calls, texts, and scam attempts for months or years afterward. Scammers also combine leaked numbers with other leaked data (like your name, address, or which company you use) to make their calls sound more convincing.

What to expect after a leak

• More robocalls and spam texts, sometimes referencing the breached company by name to seem legitimate
• Phishing attempts ("smishing") with links asking you to verify account details or claim a refund
• Calls pretending to be from your bank, a delivery service, or a government office, often using urgency or fear
• Possible SIM-swap attempts if the breach included enough personal detail to impersonate you to your carrier

Immediate steps to take

If you've confirmed your number was part of a specific breach, start with the basics:

• Change the password and enable two-factor authentication on the breached account, and on any other account using the same password
• Avoid using SMS-based two-factor authentication where possible; prefer an authenticator app, since SMS codes can be intercepted if your number is compromised
• Add a PIN or passcode to your mobile account with your carrier to prevent unauthorized SIM swaps
• Check this service or a similar number-lookup tool if you start receiving calls from unfamiliar numbers, to see if others have reported them as spam or scams
• Be extra cautious for the following weeks, since scammers often act quickly after a breach becomes public

How to handle the spam calls and texts that follow

You likely can't stop every unwanted call, but you can reduce how much reaches you and how effective it is:

• Don't answer calls from unknown numbers; let them go to voicemail. Legitimate callers will leave a message
• Never press a number to "opt out" of a robocall — this often just confirms your number is active and leads to more calls
• Report spam texts to your carrier by forwarding them to the reporting short code your carrier provides, if available
• Block numbers as they come in, and use your phone's built-in spam filtering or call-screening features
• Register your number with your national do-not-call registry if one exists in your country — it won't stop scammers, but it can reduce legitimate telemarketing

Watch for these scam patterns specifically

After a breach, scammers often tailor their approach around the leaked company or data type. Be alert to:

• Calls or texts claiming there's a problem with an account tied to the breached company, asking you to "confirm" details
• Messages offering compensation or a class-action settlement that require you to click a link or share bank details
• Callers who already know a piece of your personal information and use it to sound credible before asking for more
• Requests to move a conversation to a messaging app or to call a number they provide, rather than the one on your official statements

If you're ever unsure whether a call or text referencing an account is genuine, hang up and contact the company directly using the number on your card, bill, or official app — not a number given to you during the call.

Reducing your exposure going forward

You can't make your number un-leaked, but you can reduce how much new exposure you create:

• Avoid entering your real phone number into every website, loyalty program, or contest that asks for it; use it only when genuinely necessary
• Consider using a secondary number (a second SIM, a VoIP number, or a masking service) for sign-ups and online forms, keeping your main number more private
• Check the privacy settings of your accounts and opt out of data sharing with third parties where possible
• Periodically search your own number online to see where it appears publicly, and request removal from people-search or data-broker sites that list it
• Be selective about which apps you grant contact-list access to, since this can spread your number further

When to consider changing your number

Changing your number is disruptive, but it may be worth it if you're facing persistent harassment, repeated scam attempts tied to a serious breach, or signs of identity theft such as unauthorized accounts opened in your name. If you do change numbers, update your important accounts promptly and consider keeping the old number briefly forwarded so you don't miss anything urgent during the transition.

The bigger picture

A data breach involving your phone number is unsettling, but it's increasingly common and rarely means immediate harm on its own. The real risk comes from what scammers do with that number afterward — so staying skeptical of unexpected calls and texts, verifying independently before sharing any information, and tightening up your accounts are the most effective ways to stay protected.