A data breach is rarely the end of an attack. For many criminals, it is the reconnaissance phase: leaked names, email addresses, phone numbers and account details let them send a wave of spear phishing attacks that look personal, use real context and get past both email filters and human suspicion. The best defense is to assume your data is already exposed and verify every urgent request through a channel you open yourself.
Summary
- Spear phishing is phishing aimed at a specific person and built with details about that person. Breached data supplies those details at scale.
- The cycle has three steps: harvest the data, organize and sell it, then launch personalized email or SMS attacks.
- Second wave phishing removes the classic red flags: it uses the victim’s real name, real account details and real recent events.
- Attackers often time it to the breach notification itself, with fake “secure your account” alerts.
- Generative AI makes personalized lures cheaper to produce at scale and in any language.
What is second-wave phishing after a data breach?
Second-wave phishing is a targeted attack that uses data stolen in an earlier breach to make phishing messages credible. Generic spam is increasingly blocked by filters and ignored by users, so attackers need context, and the first breach gives it to them.
How does a data breach turn into spear phishing?
A breach turns into spear phishing in three stages:
- The harvest (round 1): a company’s database is compromised and attackers take personally identifiable information (PII) such as names, email addresses, phone numbers, home addresses and account history.
- The weaponization: the data is organized and sold on criminal forums. Organized groups analyze it to learn which services each victim uses, where they live and who they do business with.
- The targeted strike (round 2): attackers send personalized emails or SMS messages (smishing). Instead of “Dear Customer”, the message uses the victim’s real name, a real transaction or a service they actually use.
Why does second wave phishing get past people and filters?
Second wave phishing works because it looks like the messages people expect. A text that claims to come from your bank invites doubt. A text that includes the last four digits of the account exposed in a breach three months ago removes it.
- It removes red flags: advice to look for bad grammar or generic greetings does not help when the message is well written and uses exact account details.
- It exploits timing: attackers send fake, urgent-sounding security alert emails, often mimicking the company’s official breach notice, asking victims to click a link to secure their accounts.
- It uses AI: generative AI makes it cheaper and faster to produce convincing, personalized lures. IBM’s Cost of a Data Breach Report for 2025 found that in 37% of breaches where attackers used AI, generative AI shows up in phishing lures.
- It pivots to trusted brands: data stolen from a healthcare provider can be used for a message that looks like it comes from an insurer or employer.
The human factor is still the main entry point. The Verizon 2026 Data Breach Investigations Report (DBIR) found a human element in 62% of breaches.
How can individuals protect themselves from the second wave?
The safest approach is a zero-trust mindset: assume your data is already exposed and treat every urgent request as unverified until you check it yourself.
- Verify the channel, not the message: do not click links in urgent emails or texts. Open a new browser window, type the official address and check your account directly.
- Expect the pivot: a breach at one company can lead to phishing that impersonates a different, related brand.
- Compartmentalize: use unique passwords and different email aliases for different services. If one alias starts receiving targeted messages, you know which breach it came from.
- Check your exposure: see whether your email appears in known breaches with Have I Been Pwned, the free service created by security researcher Troy Hunt.
How can companies protect customers after a data breach?
Companies can protect customers by preparing for the impersonation that follows a breach, not just by closing the original vulnerability. Practical steps:
- Publish a breach notice on the organization’s main website and tell customers exactly how you will and will not contact them.
- Monitor for lookalike domains, fake support accounts and fake apps that use the breach as a lure.
- Take down phishing pages and impersonation accounts quickly, before the second wave peaks.
- Give customers a simple way to report suspicious messages that use your brand.
How PhishFort helps
PhishFort Brand Protection monitors for lookalike domains, fake support accounts and phishing pages that carry the second wave, and takes them down with registrars, hosts and platforms. PhishFort Abuse Mailbox turns customer-reported phishing into takedowns.
Frequently asked questions
What is second wave phishing?
Second wave phishing is a targeted phishing attack that uses personal data stolen in an earlier breach, such as names, emails and account details, to make fake messages look legitimate.
How do hackers use leaked data for phishing?
Hackers use leaked names, email addresses, phone numbers and account history to personalize phishing emails and SMS messages, often impersonating the breached company or a related brand right after the breach is announced.
How can I tell if a breach notification is fake?
Do not use links in the message. Go to the company’s official website or app yourself and check whether the notice appears there. Real companies do not ask for passwords or one-time codes by email or text.
How do I check if my email was in a data breach?
You can check for free at Have I Been Pwned (haveibeenpwned.com), which lists known breaches that included your email address.
Sources
- Have I Been Pwned
- Verizon 2026 Data Breach Investigations Report (DBIR).
- IBM Cost of a Data Breach Report 2025.
