A few days ago someone tried to log into my bank account, the attempt was unsuccessful but it was quite concerning. I’ve spent the past weekend moving my most important accounts to alternate emails and setting up TFA everywhere. I plan to get rid of my old email altogether since it was also used to sign up for some random websites and newsletters in the past weeks.
As a part of the clean up I’ve run a Google search for my email and found a .txt file online with my email and thousands of others. They were categorised as valid/invalid. The site was since taken down but I have screenshots.
I live in the E.U. and I’ve been thinking about a GDPR or a police report. The website owner was really easy to find and lives in the same country as me.
What should be a next step?