The surge in global data breaches is creating what cybersecurity experts describe as a cybercrime supply chain, where stolen personal information is recycled and enhanced with artificial intelligence (AI) to launch convincing attacks against individuals.
Rather than relying on random phishing emails or poorly written scam messages, cybercriminals are now combining personal data stolen from multiple breaches with generative AI tools to create highly personalised fraud campaigns that are becoming harder for consumers to identify.
The trend marks a significant shift in cybercrime. Information exposed during major data breaches including names, phone numbers, email addresses, residential addresses and passwords is no longer simply sold on underground marketplaces.
Instead, it is being aggregated, analysed and transformed into sophisticated social engineering attacks capable of deceiving even security-conscious users.
Every new data breach adds another piece to a growing pool of personal information that criminals can exploit. Once combined with AI, these datasets enable attackers to imitate trusted organisations, family members and colleagues with remarkable accuracy.
The result is a cybercrime ecosystem where stolen data fuels the next wave of attacks.
AI makes scams more believable
Generative AI has really lowered the barrier for cybercriminals to create realistic phishing emails, fake customer support messages and even cloned voices.
Consumers may receive an AI-generated phone call that sounds like a close relative requesting urgent financial assistance.
Others could receive a banking notification that perfectly mimics the design and language of their financial institution, or an email that appears to come from their employer asking them to reset their password through a malicious link.
Unlike traditional scams riddled with spelling mistakes and generic greetings, AI-powered attacks often include accurate personal details drawn from previous breaches, making them significantly more persuasive.
This level of personalisation increases the likelihood that victims will trust the communication and unknowingly surrender sensitive information such as login credentials, one-time passwords or banking details.
Remote work expands the attack surface
The continued rise of hybrid and remote working has also widened opportunities for cybercriminals.
Many employees now access corporate systems using home internet connections and personal devices that lack enterprise-grade security protections.
Home Wi-Fi networks frequently operate with weak passwords or outdated firmware, while personal laptops may not receive regular security updates or have advanced endpoint protection software installed.
Attackers exploit these weaknesses to steal login credentials, compromise remote access software and infiltrate both personal and business accounts.
Once credentials are stolen, they can be reused across multiple online services, particularly where users recycle the same password.
The convergence of personal and professional digital lives means a compromised home device can become an entry point into an employer’s network thereby increasing risks for businesses while exposing individuals to financial fraud and identity theft.
Why are consumers are targeted?
Previously, cybercriminals primarily targeted organisations holding valuable financial or customer data.
Today, individuals have become equally attractive targets.
Personal information collected from breaches can be monetised in numerous ways, including account takeovers, identity theft, financial fraud and credential stuffing attacks, where stolen usernames and passwords are automatically tested across multiple online platforms.
How individuals can protect themselves
Consumers can significantly reduce their risk by adopting stronger digital security habits.
Here are some important steps:
Use unique passwords for every online account and store them in a reputable password manager.
Enable multi-factor authentication (MFA) on banking, email, social media and work accounts to provide an additional layer of security if passwords are stolen.
Be sceptical of urgent requests, even if they appear to come from family members, employers or financial institutions. Verify requests through a trusted phone number or another communication channel.
Keep devices updated by installing the latest security patches for operating systems, browsers and applications.
Secure home Wi-Fi by changing default router passwords, using WPA3 or WPA2 encryption where available, and regularly updating router firmware.
Avoid clicking links in unsolicited emails, text messages or messaging apps. Instead, visit organisations’ websites directly by typing the address into your browser.
Monitor financial and online accounts regularly for suspicious activity and change passwords immediately if a service reports a data breach.
Limit the amount of personal information shared publicly on social media, as attackers often combine publicly available information with stolen data to strengthen their scams.
Vigilance remains the strongest defence
As AI continues to transform both cybersecurity and cybercrime, consumers will need to combine stronger digital security practices with greater awareness of how modern scams operate.
With every major data breach feeding a growing cybercrime supply chain, protecting personal information is no longer solely the responsibility of organisation because individuals are becoming the last line of defense against AI-powered fraud that is faster, smarter and more convincing than ever before.