A message announcing a data leak often leaves a question unanswered: what does it mean for the person concerned? An exposed email address, disclosed administrative information and a compromised account are different situations.

A notification figure, not an account takeover figure

According to the “Étude Ipsos bva pour Cybermalveillance.gouv.fr”, 45% of respondents said they had been informed of a leak of their personal data in the previous twelve months, compared with 30% in the 2025 edition.

The 2026 survey was conducted online from 13 to 18 May among 2,000 people, representative by quotas of France's population aged 18 to 75. This self-reported finding therefore does not mean that 45% of French people experienced account takeover, or that every leak has been counted.

Person using a laptop and a smartphone
Illustrative photo: Alejandro Escamilla, 2013 — CC0.

Risk can continue after the announcement

Cybermalveillance.gouv.fr notes that disclosed data can feed personalised phishing and financial scams. A message containing accurate information about its recipient may appear credible without being authentic.

Our analysis: data exposure changes how a solicitation should be interpreted. Knowledge of a personal detail is no longer, by itself, a basis for trust.

Support through day 30

On 1 October 2026, CNIL and Cybermalveillance.gouv.fr presented a new resource covering data breaches. It structures support from the day of discovery through day 30.

This approach places notification within a longer timeframe. It recognises that consequences and questions do not necessarily arise only in the first few hours.

Informing without creating permanent alarm

Our analysis: useful information should specify the data affected and plausible risks. A general alert can create worry without understanding. Conversely, treating notification as a mere formality can obscure potential consequences.

Conclusion: understand what was exposed

Cybermois 2026 emphasises support after a leak. The goal is a proportionate understanding of the incident: being informed of a breach does not automatically make someone a victim of every possible consequence.