Your Exchange Sent a Data Breach Notice: A Retail Response Checklist for 2026

By CoinX Editorial (gspteck) · Published 2026-10-07 · Last verified 2026-10-07

Sooner or later, many retail traders get an email saying their exchange, wallet vendor, or a service provider "experienced a security incident" involving customer data. The usual first reaction is to check whether the funds are still there. If they are, most people move on. That is often exactly when the real risk begins. Leaked customer data is rarely the end of an attack. It is usually raw material for the impersonation calls, texts, and emails that follow. This checklist explains what leaked exchange data is typically used for, how to verify a breach notice, what to do for each type of exposed data, and how long to stay alert. It is educational account-security hygiene, not financial or legal advice. It complements our guides to fake exchange support and recovery scams and anti-phishing codes and bookmark-only login.

What leaked customer data is used for

Two public incident disclosures show the pattern clearly. Both are worth reading in full:

Coinbase, 2025-05-15. In Protecting Our Customers - Standing Up to Extortionists, Coinbase said criminals bribed a small group of overseas support agents to copy customer data for less than 1% of monthly transacting users. The data included names, addresses, phone numbers, emails, the last 4 digits of Social Security numbers, masked bank-account numbers, government-ID images, and balance snapshots and transaction history. Coinbase said no passwords, 2FA codes, or private keys were taken. It described the goal as building a list of customers to contact "while pretending to be Coinbase—tricking people into handing over their crypto."
Ledger, 2020. In its CEO update on the July 2020 data breach, Ledger said about 1 million email addresses were stolen from its e-commerce database, and a later public dump contained about 272,000 records with names, postal addresses, and phone numbers. Ledger said customers were targeted by email and SMS phishing campaigns seeking their 24-word recovery phrase, and that some customers raised concerns about physical attacks because shipping addresses had leaked.

In neither case did the breach itself move funds. The risk of loss comes afterward, when a stranger contacts you already knowing your name, your address, roughly what you hold, and which platform you use. That knowledge is what makes the follow-up call convincing.

Four-step chain: customer data leaks, attackers build a target list sorted by likely holdings, fake support quotes the victim's real details, victim is pushed to send funds to a so-called safe wallet with no reversal — A breach usually turns into losses through impersonation. Your real details make the fake support call believable.

Step 1: Verify the notice without clicking it

Breach notices are a popular phishing template, because people expect them and act fast. Treat the email as a prompt to go check, not as instructions to follow:

Open the exchange app you already have, or type the address from your own bookmark. Look for the notice in the in-app inbox, the official blog, or the status page.
Do not call phone numbers, reply to the email, or use links from the message. A real notice will still be there when you visit the official site yourself.
If the email asks you to "verify your identity," "claim compensation," or "secure your account" through a link, assume it is phishing until the exchange's own site confirms it.

The FTC's guide to recognizing phishing covers the general warning signs. The exchange-specific habit is simple: only act on account messages you found by going to the exchange yourself.

Step 2: Match each exposed data type to an action

A good notice lists what was exposed. Respond to each item on its own terms rather than doing one generic password change:

Six exposed data types and responses: email means expect phishing, phone means set a carrier PIN and hang up on callers, postal address means stay private offline, ID images mean consider a credit freeze in the US, balances mean ignore callers who say they know your account, bank references mean turn on bank alerts — Each leaked field enables a different attack, so each gets its own response.

Email address. Expect more convincing phishing. Turn on the exchange's anti-phishing code if it has one, and harden the inbox itself (see our linked-email hardening guide).
Phone number. Expect vishing calls and SMS. Ask your carrier about a port-out or SIM PIN, and move exchange 2FA off SMS, as covered in our SIM-swap guide.
Postal address. Don't discuss holdings publicly, and be wary of physical mail or "replacement device" parcels you didn't order.
Government-ID images or partial national ID numbers. This is identity-theft material. In the US, the FTC's page on credit freezes and fraud alerts explains that a freeze is free, doesn't affect your credit score, and stops anyone opening new credit in your name. You place it with Equifax, Experian, and TransUnion. Outside the US, ask your national credit bureau or data-protection authority what the equivalent is.
Balances and transaction history. Expect callers who quote real numbers back to you. Knowing your balance proves nothing about who someone is.
Bank references. Turn on transaction alerts, ask your bank whether the exposed reference calls for further steps, and treat any "bank verification" call about the exchange as suspect.

Step 3: Harden the account anyway

Even when a notice says passwords and 2FA were not exposed, the breach makes you a more likely target, so use it as the occasion to tighten the account:

Change the exchange password to a unique one stored in a password manager.
Switch to the strongest 2FA offered. Coinbase's notice recommended hardware keys as the best option.
Enable a withdrawal allowlist so funds can only go to addresses you control (see our withdrawal allowlist guide).
Review and revoke logged-in devices and sessions, as covered in our sessions audit.
Find the exchange's account lock feature now, so you can use it fast if something feels wrong.

Step 4: Know the script before the call comes

The follow-up call usually sounds like a security team: "We detected suspicious activity, your account is at risk, move funds to a protected wallet while we investigate." Coinbase's notice is blunt about this. It says it will never ask for your password or 2FA codes, never ask you to transfer assets to a specific or new address, and never call or text you with a new seed phrase or wallet address. The FTC's guidance on cryptocurrency scams makes the general point: no legitimate business demands that you send cryptocurrency, and impersonators often push a wallet address "for safe keeping."

Comparison: real exchange support is reached through the app you open, never needs your 2FA code, never moves funds for you, and is fine if you hang up; an impersonator calls or texts first, asks for codes or a seed phrase, pushes a safe wallet, and creates urgency — The tell is the direction of contact and the request. Real support never needs your codes or a transfer to a "safe" wallet.

Decide your own rule in advance: I hang up, open the app myself, and contact support from there. A real security team will not object. A scammer will push harder, which tells you everything.

Step 5: Stay alert for months, not days

Leaked data does not expire. Names, phone numbers, and addresses get resold and reused long after the news fades.

Timeline: day 0 verify the notice inside the app, week 1 harden the account with allowlist and security keys, months 1 to 3 watch for follow-up scams, ongoing because leaked data never expires — Verify on day 0, harden in week 1, then keep the hang-up rule for as long as the data is in circulation.

Watch for "compensation" and "class action" messages. Fake claim sites and recovery services often follow a public breach, and they ask for fees, ID uploads, or wallet connections.
Check your credit reports if ID documents were exposed. US residents can use the FTC's IdentityTheft.gov data breach steps, which are organized by the type of information exposed.
Report scam contacts to the exchange through its own app, and in the US to the FBI's Internet Crime Complaint Center and the FTC. Elsewhere, use your national police fraud-reporting service.
Check other exposures. Have I Been Pwned shows whether your email appears in other known breaches. Combined leaks make targeting easier.

Key takeaways

A customer-data breach rarely moves funds directly. The losses come from impersonation that uses your real details.
Verify any breach notice by opening the exchange yourself. Never act through the notice's links or numbers.
Respond per data type: phishing defenses for email, carrier PIN and non-SMS 2FA for phone, and credit freezes (in the US) for ID documents.
No real exchange needs your 2FA code, your seed phrase, or a transfer to a "safe" wallet. Hang up and open the app yourself.

Educational security hygiene only, not financial, legal, or investment advice. Incident details are summarized from the companies' own public disclosures, and consumer steps from FTC and FBI IC3 resources, as of 2026-10-07. Credit-freeze steps described are US-specific. Check your exchange's official help pages and your local authorities for your situation. No affiliate links. Last verified 2026-10-07.