“Stay Vigilant” Is Not a Breach Response

In the last week of October 2026, customers of two unrelated companies received notices that their data had been exposed through a third party. Japan Airlines said hackers had reached a portion of reservation data held by its IT provider Amadeus. ENGIE said attackers had broken into a marketing tool used by its business partners for prospecting. Both messages ended with the same instruction in different words: watch out for phishing.

A reminder to be vigilant is not wrong. It is the least expensive thing a notice can say, and it hands the remaining work to the person with the least information.

What the two notices said

We worked from press coverage of each notice, not from the original letters, so details below are as reported. Where a figure appears, we say who reported it.

Sources: The Record for JAL, BleepingComputer for ENGIE. The JAL notice, as reported, is the more specific of the two: it gives a number and splits the exposure by data type. ENGIE’s coverage is more guarded about scale. Neither piece suggests anything improper in what was disclosed. The question here is what the notices equip a reader to do.

What “be vigilant” asks a person to do

Take the ENGIE data set: a name, address, phone number, the identifier of a metering point and a contract number. That is the raw material for a very convincing call from “your energy supplier” about a contract. It is also exactly what a genuine supplier might use in a genuine call. “Be vigilant against phishing” then asks the customer to tell a real call from a fake one with no further information, in a situation where the fake caller knows more about their account than most callers do.

The JAL case has a particular twist. A passport number and phone number sit among the exposed fields for about 2,000 people. A caller who quotes a reservation code and a flight is not guessing. That detail is what people have been taught to treat as proof of legitimacy. A notice that does not tell customers how the company will, and will not, contact them leaves that teaching intact.

What FTC guidance tells businesses to say

The FTC’s Data Breach Response: A Guide for Business is written for U.S. companies, but its structure is a useful yardstick. It says to “clearly describe what you know about the compromise,” including how it happened, what information was taken, how thieves have used it if known, and what actions the company has taken to remedy the situation. It also lists what the company is doing to protect people and how to reach a contact. The model letter uses six headings: What Happened, What Information Was Involved, What We Are Doing, What You Can Do, Other Important Information, For More Information.

Two lines in that guide matter most for the “vigilant” problem. On the “What You Can Do” section, it says to “tell people what steps they can take, given the type of information exposed.” And it suggests explaining how you will contact people in the future, so they can recognize legitimate follow-up and avoid phishing scams. Generic reminders do neither. They do not vary with the data, and they do not describe the channel.

A rewrite of the weakest paragraph

Here is an invented example, not a quote from any company, built from the pattern above for a case where names, contact details and contract numbers were exposed.

The information involved included your name, address, phone number and contract number. It did not include payment details or passwords. Someone who has this information may call or message you pretending to be us and quote your contract number to sound genuine. A contract number does not prove a caller is from us. We will never ask you for a payment, a password or a one-time code by phone, email or text. If you receive a call or message about your account, hang up or do not reply, and contact us on the number printed on your invoice. We will write to you at your postal address about any changes.

That paragraph is longer than “stay alert.” It also does four things the short version cannot: it names the data, so the reader knows what a caller might know; it warns that quoting the data proves nothing; it states what the company will never ask for; and it names a route the customer opens, not one the caller supplies.

Why short notices persist

There are understandable reasons. Legal teams prefer statements they can defend; a promise about “never” can be wrong if some team in the company does call people. Investigations are unfinished when notices go out. Rules differ across jurisdictions, and a notice often has to serve several at once. A generic caution can be issued the day the facts are partly known.

These are real constraints and they are worth stating rather than ignoring. But they argue for something more specific, not for less. A company can say “we have not finished the investigation” and still say what it will never ask for. If a “never” is unsafe because some internal team does phone customers, that is itself a finding: the company’s contact routes are not yet consistent enough to teach. We take up that wider problem in our note on what happens when a conversation changes channel.

What a customer can do while waiting for better notices

• Treat the notice as a map of what a scammer knows. If addresses and phone numbers were exposed, assume the next call may be well-informed. Detail in a caller’s story is not evidence.
• Reach the company yourself. Use the number on a document you already have, not one in a message. Our piece on support numbers that arrive through search explains why even looking one up needs care.
• Match the advice to the data. If a passport number or national ID was exposed, ask the issuer what it recommends. The FTC’s guide points U.S. readers whose Social Security numbers were exposed to credit bureaus and IdentityTheft.gov/databreach.

None of that should be the customer’s job alone. A breach is something done to them. The most useful part of a notice is the part only the company can write.

Three questions for whoever drafts the next notice

Teams under time pressure tend to start from the previous notice. A better starting point is a short set of questions, each answerable before the investigation is finished.

1. What would a caller know that makes them sound real? List the exposed fields and read them as a script. If a name, an address and a contract number are enough to sound credible on the phone, the notice should say so in as many words.
2. Which channels will we use, and which will we never use? If the answer is uncertain, find out before the letter goes. A contradiction between the support desk and the notice is worse than silence.
3. What can a person do today that they could not do yesterday? A lock, a freeze, an alert, a number to call. If the honest answer is “nothing,” say that and say what the company is doing instead.

The same questions work in reverse for a reader. A notice that cannot answer them is telling you something about how settled the facts are, and that is useful to know even when it is uncomfortable.

A note on timing

Both notices were issued within days of the companies learning of the exposure; JAL said Amadeus had informed it the previous week, and the ENGIE letters were dated October 23. Early notices are valuable, and speed is not the fault here. The point is that a fast notice can still carry the specific guidance, because the data types are known before the cause is.

Sources

• Japan Airlines warns of breach (The Record, October 28, 2026): JAL and Amadeus details, figures and quoted advice.
• Energy giant ENGIE discloses data breach affecting customers (BleepingComputer, October 27, 2026): data fields, ENGIE statement, scope.
• Data Breach Response: A Guide for Business (FTC): notification contents and model-letter headings.