Maybe it was from AT&T, maybe your health insurer, maybe a hotel chain you stayed at once in 2014.
The subject line is always some variation of "Important Notice Regarding a Security Incident," and it always arrives about four months after the actual incident.
Congratulations, you're part of a data breach.
In plain terms, it's when someone who shouldn't have access to a pile of information gets access to that pile of information.
Names, Social Security numbers, passwords, credit card digits, medical records, that one security question about your mother's maiden name that you've used on every account since 2009.
If a company stores it, somebody somewhere is trying to steal it.
The "somebody" is usually not a lone hacker in a hoodie, despite what every cybersecurity commercial wants you to believe.
It's often organized criminal groups, sometimes a nation-state, and occasionally it's just an employee who clicked a link in an email that said "Your package could not be delivered." Phishing, ransomware, unpatched software, a misconfigured cloud server left wide open like a garage door — the methods are boring and effective.
Here's the part that stings: most breaches don't get discovered by the company.
They get discovered by security researchers, or by hackers posting the data for sale on a forum, or by journalists who call the company and ask, "Hey, is this you?" The average time to identify a breach is measured in months, not minutes, which means your information could be circulating while the company is still drafting the apology.
It will mention "unauthorized access," "a sophisticated threat actor," and "we take your privacy seriously." It will offer you 12 months of free credit monitoring, which is a bit like someone leaving your front door open and then handing you a coupon for a deadbolt.
You can freeze your credit, use unique passwords, turn on two-factor authentication, and stop reusing the same password across every website like it's a family recipe.
That won't stop breaches from happening, but it means a breach at one company doesn't automatically become a breach at all of them.
The uncomfortable truth is that data breaches are less of an anomaly and more of a subscription service at this point.
You're not "if," you're "when." The only real question is whether you find out from the company or from some guy on a forum selling your email address in a bundle of ten million others.
The closing thought: companies keep treating your data like an asset to be monetized and a liability to be ignored, and until that math changes, expect more of those emails.
Final Thoughts
It takes ten minutes and it's the closest thing to actual protection you're going to get.