PRIVACY & DATA BREACH DETECTIVE
Privacy & Data Breach Detective
Where did my data go, and who turned it into money?
From collection to breach, takeover, resale, financial loss and compensation. Not just "how many leaked", but how far one breach reaches.
How to read thisEvery fact is graded. Attacker nationality or base, use of proceeds and organisational structure appear only with law-enforcement or court records; a login country is never treated as nationality. Attack methods, tools and illegal markets are not covered.
IDENTITY DEPENDENCY CHAIN
Your email is a master recovery key
Typical pattern: external email compromise → streaming takeover. The streaming service was not breached; the recovery channel it trusts was.
- Email account taken (phishing, reused password, malware…)
- Attacker uses "forgot password" on the streaming service — the link goes to that email
- Account email, password and profiles changed
- The real owner is locked out
- The saved payment method can keep being charged
- Recovery needs the service’s support team
An explanatory model; it does not blame any email provider or country. For an official banking case see the FBI alert below.
Self-check: what falls with your email
For each service you use, tick how a forgotten password is recovered (see each account’s recovery settings). Calculated on this screen only; nothing is stored or sent.
- Accounts reachable if your email is taken
- Streaming (e.g. Netflix) · Online shops · Social media
- If your phone number (SMS) is taken
- Online shops
Single point of failure: one email recovers 3 accounts. Give it a unique password and an authenticator app or passkey.
CASES
Case files
KT · Rogue base station
16,647 people (de-duplicated, incl. MVNO) · Phone, Device / subscriber ID, Other · loss ₩240m · fines ₩54bn
Coupang · Insider
37,560,840 people (33,222,472 members + at least 4,338,368 non-members) · Name, Email, Phone, Address · fines ₩624.7bn
SK Telecom · Malware
23,244,649 people (LTE/5G incl. MVNO, de-duplicated) · Phone, SIM authentication key, Device / subscriber ID, Other · fines ₩134.8bn · detected after ~1,357 days
FBI Internet Crime Complaint Center (IC3) · Social engineering · Phishing
5,100 + complaints to IC3 since Jan 2025 · Login ID, Password, Auth token / one-time code, Bank account · loss $262m
INTERPOL and police in 26 countries · Infostealer
216,000 + victims and potential victims notified · Login ID, Password, Session cookie, Payment card
US DOJ/FBI, Europol, Microsoft · Infostealer
394,000 + infected Windows PCs (16 Mar–16 May 2025, Microsoft) · Login ID, Password, Session cookie, Crypto-wallet data
CRIMINAL SUPPLY CHAIN
It is not one hacker doing everything
Europol describes a crime-as-a-service market where stolen data, access and malware are traded. Stealers, access and data brokers, buyers, takeover and fraud operators, mules, launderers and cash-out may be different people — and criminals without skills can rent the tools. International agency 2025-06
Victim data stolen → Brokered and resold → Buyer takes over accounts → Fraud or unauthorised payment → Mule account → Laundering → Cash-out
- Access broker
- Sells access to already-compromised accounts or companies
- Data broker
- Packages and resells stolen data
- Fraud operator
- Turns controlled accounts into money
- Equipment operator
- Runs the criminal equipment on the ground — confirmed in: KT
- Mule recruiter
- Recruits money mules and their accounts
- Money mule
- Receives and moves criminal funds — can be prosecuted even if unaware
- Launderer
- Hides where the money came from
- Cash-out
- Converts proceeds into cash, gift cards, etc. — confirmed in: KT
- Organizer
- Plans and directs the scheme
- Insider
- An employee or ex-employee with access — confirmed in: Coupang
WHO BUYS STOLEN DATA
What stolen data is used for
- Identity data only
- Spam, impersonation calls, targeted phishing (e.g. luring you into a reset)
- Email + password, cookie or code
- Account takeover, including other services sharing the password
- Card or account data
- Payment fraud, unauthorised transfers
- Full identity package
- Identity fraud — loans, phone lines, new accounts
- Health or biometric data
- Extortion and discrimination risk; cannot be changed
Buyers include takeover, financial, identity, phishing and extortion criminals, and other brokers; the same data can be resold and bundled many times. Prices and venues are not covered. International agency 2025-06
CRIME REVENUE FLOW
How the money leaves
Victim account → criminal-controlled (mule) accounts → transfers, crypto → laundering → cash-out. The FBI says funds move fast to other criminal accounts, many tied to crypto wallets, making recovery hard. Law enforcement 2025-11
Money mules — INTERPOL: people recruited — via fake jobs, romance, investment or a "favour" — to receive and move criminal funds. They can be prosecuted even if unaware. International agency 2022
Use of proceeds is shown only when seizures or rulings confirm it — no generalisations. Laundering (hiding the source) is kept apart from final spending.
GEOGRAPHY
Login country ≠ attacker nationality
VPNs, proxies and hijacked devices make login countries unrelated to where attackers are. Location is therefore recorded in six separate fields: Observed login country · Infrastructure location · Suspect nationality · Suspect operating base · Arrest country · Victim country.
No country is labelled a source of crime. Nationality appears only for individuals named by investigators.
WHERE DID MY DATA GO
Lawful data flows are not the same as crime
- Third-party provision
- Handing data to another company for its own purposes — needs consent or a legal basis
- Processing on behalf
- Delivery, call centres, cloud handling data for the company — disclosed in the privacy policy
- Advertising use
- Only within separately consented scope
- Overseas transfer
- Transfer to servers or processors abroad — countries and items must be disclosed
- Illegal sale / unauthorised transfer · unlawful
- Passed on without a basis or stolen — a crime
Each company’s privacy policy discloses what it collects, its processors, third-party provision and overseas transfers. A policy decoder will follow.
REGULATORY OUTCOME
Fines and enforcement
Fine size depends on revenue, duration and mitigation; it is not a direct measure of security. There is no single "security score".
USER PROTECTION
Protect yourself and report
- A different password per service + a password manager
- Stops one leak from spreading to other accounts.
- Make your email the strongest account
- Most services send reset links to email — it is the master recovery key.
- MFA — preferably passkeys or an authenticator app
- SMS codes can be intercepted or talked out of you; never give a code to a caller.
- Turn on login and payment alerts
- You see email changes, new-device logins and micropayments immediately.
- Block or lower carrier micropayments
- As in the KT case, phone billing can become a cash-out route.
- Identity-theft blocking and account look-up
- Check nothing was opened in your name.
Where to report
If an account was taken, contact the service and your card issuer first to stop charges; report money loss to the police.
SOURCES
NOTE Case sources are on each case page.