Dark web alert from your bank? It doesn't mean the bank was hacked.

Chase Credit Journey (powered by Experian) alerts aren't proof of a Chase breach or identity theft. They mean data leaked somewhere is circulating.

That somewhere is often outside the bank.

  • Goldman Sachs: client data exposed via a breach at tax adviser EY
  • Revolut: data handed to impostors posing as a government agency (~680 accounts, single SecurityWeek report; no official figure)
  • ING: some customers hit via a breach at logistics firm CEVA

None of these breached a bank's core systems.

Leaked data fuels bank impersonation. In Canada, fake "bank investigators" caused about C$28.6M in reported losses in H1 2026.

  • Check in your bank app or via the number on your card, not the link
  • Requests for passwords, codes or a "safe account" transfer = scam
  • Got an alert? Change passwords, then add a credit freeze or fraud alert

Sources: Chase, Capital One, Silicon UK, SecurityWeek, NL Times, Infosecurity Magazine, RBC, Canadian Anti-Fraud Centre, FTC

Photo: Chase