The steps below are the ones that actually reduce your risk. None of them costs anything.
Watch for accounts opened in your name
This is the risk that matters most, because identity details cannot be reissued the way a card can. Look out for letters, emails or calls about accounts, loans or credit applications you did not make. If something arrives that you do not recognise, follow it up rather than filing it.
Put a marker on your credit file
Most countries have credit reference agencies or credit bureaus that will place a fraud alert or a freeze on your file at no charge. A freeze stops most new credit being opened in your name until you lift it. The bodies differ by country, so search for the ones that operate where you live, or ask us and we will point you to them.
Your Yacht Week password was not copied
The table holding Yacht Week account passwords was never accessed, so there is no forced password change here. See Do I need to change my Yacht Week password?
Reused passwords are a different matter. If you have used the same password on other services, change it there — whoever holds this data also holds your email address, and that combination is what makes an attempt on your other accounts worth trying.
One exception. If you were a Yacht Week skipper, host or Event Team member, your record was most likely moved to Quarterdeck when that company was set up, and the Quarterdeck position on passwords is different — they were copied there. If that is you, write to us and we will check your specific record, or see help.quarterdeck.co.
Check your statements
The card reference we held is a token and cannot be used to take a payment, so there is no specific reason to expect card fraud. Checking your statements is still never wasted.
Slow down on unexpected contact
Expect more convincing scam attempts than usual, by email, text and phone. Someone referencing your trip, your dates or your booking is not thereby proving they are us. Verify independently before acting, and never through a link or number supplied in the message itself.
We are not making outbound calls about this incident, so any phone call claiming to be us about it is not us. If you want to check whether a message is genuine, see Is this notice genuine, or is it a scam?
Your passport is probably not the thing to worry about
No scans, photographs or signatures were held or taken — only the number as text. See Do I need to replace my passport?
If something does happen
If you see anything that looks like misuse of your information, tell us. Write to the notice address on your security notice and we will look at your case individually rather than sending you the general guidance again.