Reading a breach disclosure: what scope language, password hashes and timing actually tell you
A breach notice is a strange genre: written by lawyers, released under regulatory pressure, built to confirm as little as possible. When Marks & Spencer told customers in May 2025 that some personal customer information had been taken in the attack that had already kept its online store closed for weeks, the sentence carried more than its length suggests. Every notice answers three questions: how far the intrusion reached, how usable the stolen data is, and how long the organisation has known.
Scope language: the verbs are the story
The most informative word in any notice is the verb. An unauthorised party may have had access means the investigation has confirmed nothing yet. Data was copied or was exfiltrated means forensics observed movement. Regulators hedge the same way: California's breach statute is triggered when unencrypted personal information was acquired, or reasonably believed to have been acquired, by an unauthorised person. That gap between proof and belief is where most notices live.California requires notice when unencrypted personal information "was acquired, or reasonably believed to have been acquired, by an unauthorized person" (Office of the Attorney General).Breach itself stretches further than people assume. Have I Been Pwned defines one as an incident where data is inadvertently exposed in a vulnerable system, usually due to insufficient access controls; no intrusion required. The same FAQ separates unverified breaches, where the data looks genuine but legitimacy could not be established, from fabricated ones aggregated from other sources. Scope also grows. Zacks announced a breach in December 2022 that early reports pegged at 820,000 customers; by June 2023 a corpus of almost 9 million accounts had surfaced on a hacking forum; in February 2025 a cybercriminal published a dataset reported at 12 million records. No company notice ever confirmed the larger figures. Treat the first number as a floor, not a fact.
The password sentence decides how fast you move
If passwords were involved, the storage format is the urgency dial. Hashes protected by bcrypt, scrypt or Argon2 are deliberately slow to guess; at sane work factors, most attackers move on. Unsalted MD5, SHA-1 or a single pass of SHA-256 falls to commodity graphics cards at billions of guesses per second. Plaintext needs no cracking at all. The Zacks corpus is the textbook case: unsalted SHA-256 hashes, despite the company's assurance that attackers gained access to encrypted passwords, but only in the encrypted format. Encrypted is a favourite corporate word. Salted is the one that protects you. When a leak listing claims plaintext, treat it as the catastrophic case while asking whether the listing itself holds up. The alleged 47.9 million-record dump from Korean delivery app FLY, which we covered in August, claimed plaintext passwords and live payment keys and stayed unverified at publication. Unverified does not mean harmless; it means unproven, and Have I Been Pwned is blunt that absence of evidence is not evidence of absence. Either way: assume the password is compromised and replace it everywhere it was reused.What payment data does and does not imply
Payment information involved sounds alarming and often is not. The phrase covers everything from full card numbers with CVV, which are immediately dangerous, to masked or truncated digits that cannot be charged. Merchants frequently never hold the full number; payment processors do. When M&S confirmed that customer data had been taken, it said the data did not include usable payment or card details, because the company does not hold them on the affected systems, and no account passwords either. Read the other way: contact details and order history were taken, fuel for convincing phishing rather than card fraud. Match the response to the data class, not to the word payment.Why the notice arrives weeks late
The gap between discovery and disclosure is structural, not necessarily evasion. Forensics takes time, scope grows as logs are read, and regulators run their own clocks on top. The UK's ICO requires organisations to notify it as soon as possible, and where feasible within 72 hours of becoming aware, with detail to follow. California requires a sample copy of every customer notice sent to more than 500 residents to be filed with the state, making the filing database a public archive of real notices. NIST's incident response guidance, updated in April 2025, treats containment, evidence preservation and coordinated recovery as one deliberately slow process. M&S had already kept its online store closed for more than three weeks before it confirmed on 13 May that customer data had been taken. The silence was the distance between suspicion and something a company can put in writing.What to do first, and what to ignore
The first hour after a relevant notice matters more than the remediation voucher. In order:- Set a unique password on the affected account, and change it anywhere the old one was reused.
- Force sessions to expire: a password change usually does this, but revoke connected sign-ins and API tokens where offered.
- Enable multi-factor authentication while you are still logged in.
- Follow the data class: full card numbers means watch for your bank, not the merchant; contact details means expect phishing that quotes your order history.