When a brand emails you that a third-party marketing vendor was breached, don't panic. Work through it step by step. Read what was exposed, match it to OAIC guidance for that data type, harden the accounts that matter, and treat every follow-up message as a possible scam until you verify it yourself.

Photo: Gugalcrom123 / Wikimedia Commons, CC BY-SA 4.0, modified.