Your data was leaked. Here is where it goes next

A breach notification lands in your inbox and then nothing seems to happen. Stolen data tends to have a long life, and the risk to you usually arrives in the form of a very convincing message.

More than a million people in Australia and New Zealand have received breach notices from Mathspace alone in recent weeks. Most will hear nothing more about it. That quiet can be misleading, because the theft is usually only the first step.

Step one: the theft. Attackers get in, often through a weakness in software the company relies on, and copy what they can reach. What they take varies. In Mathspace's case it was names, email addresses and account details. In the worst breaches it can include identity documents and financial information.

Step two: sale, leak or ransom. Criminal groups often try to extort the company first, threatening to publish the data unless they are paid. If that fails, the data may be dumped publicly or sold on criminal marketplaces. Even when a company says it has found no evidence of publication, as Mathspace has, data can surface later.

Step three: combination. On its own, an email address is worth little. Combined with a name, a phone number, a school, a bank or a password from another breach, it becomes a profile. Each new breach adds pieces.

Step four: the scam. This is where the harm reaches you. Criminals use what they know to make a message believable. Knowing a person's name, a password, or who they bank with and their account number can be the difference between a scam that is believed and one that is not. The messages often pretend to come from the company that was breached, a bank or even the police, sometimes referring to the breach itself.

Step five: identity misuse. Where identity documents are exposed, criminals may try to open accounts, take over existing ones or make transactions in a victim's name, according to the Australian Cyber Security Centre.

The Australian Cyber Security Centre's advice on what to do is practical. Change your password by logging in directly rather than through any link in a notification, and use a different password for every account. Turn on multi-factor authentication wherever it is offered. Check which devices are logged in to your accounts and remove any you do not recognise. If sensitive documents were exposed, contact IDCARE, the national identity and cyber support service, on 1800 595 160 for a tailored response plan, and tell your bank.

The single most useful habit is suspicion of unexpected contact. If a message asks you to confirm details, click a link or act urgently, contact the organisation through a number or website you find yourself.

Individual vigilance helps, but it is a patch on a bigger problem. Companies collect and keep far more personal information than they need, and every extra year of storage is another year of exposure. Australian privacy law already requires organisations to destroy or de-identify information they no longer need, and we expect the regulator to enforce that far harder as breaches keep piling up. Until then, assume some of your details are already in circulation, and make yourself a harder target: unique passwords, multi-factor authentication and a sceptical eye on every message that seems to know a little too much.