back
Confirmed False
A headline reading "Company Hacked: Millions of Customers' Personal Data Stolen" spread rapidly across social platforms. Readers took it to mean that the personal details of millions of the company's customers were stolen and are now in criminal hands.
Example Media Group Ltd. — registered in Cyprus, beneficial owner undisclosed
The article beneath the headline is more cautious than the headline itself. It says a security incident occurred and that the company is investigating. It does not state that millions of records were taken. The word "millions" appears only in the headline.
The company's official disclosure, filed with the data protection regulator, describes unauthorised access to a marketing database. The database held email addresses and first names for about 38,000 newsletter subscribers. It did not contain payment details, passwords or home addresses.
The "millions" figure appears to come from the size of the company's total customer base, which is roughly 4 million. The headline writer seems to have equated the company's overall customer count with the number of people affected. The regulator filing contradicts that assumption.
An independent security researcher who reviewed the incident confirmed that the compromised system was isolated from the company's payment and account infrastructure. The researcher found no evidence of wider access, and no listing of the company's data on the criminal marketplaces monitored.
The breach is still real, and the affected subscribers were right to be notified. Phishing emails aimed at them are a genuine risk. But the headline inflates the scale by a factor of roughly one hundred and implies that sensitive financial or identity data was exposed, which the evidence does not support.
The publisher updated the article body after Norwell's disclosure but left the original headline unchanged. By then the headline had been shared tens of thousands of times, and the correction reached only a fraction of that audience.
Confirmed False
False. A breach occurred, but the claim that millions of customers' data was stolen is false: about 38,000 subscribers were affected and no sensitive data was exposed.
Legal Context
National Law:
This content may violate provisions under the Criminal Code §XX regarding the dissemination of knowingly false information affecting public order.
EU Framework:
Relevant under Regulation (EU) 2022/2065 (Digital Services Act), Article 34 — systemic risk assessment obligations for very large online platforms.
DSA Reference:
Platform notification submitted under DSA Art. 16. Response pending as of 2026-03-01.
Based on the evidence reviewed, the claim as stated is demonstrably false. The publisher has a documented pattern of using inflated headlines, and the specific assertions made are contradicted by primary data from the regulator filing and the company's disclosure.
This finding has been cross-referenced with two independent fact-checking organisations. No credible evidence of a breach on the scale implied was identified during the review period.
https://example.com/original-source/article-12345
https://example.com/original-source/article-12345
https://example.com/original-source/article-12345
https://example.com/original-source/article-12345
If new evidence surfaces, this report gets updated. Every change is logged. We're building toward cryptographic version control, so every update will be permanently auditable. Until then, changes are documented manually and dated.
Original Publication Date
RED DOT doesn't run ads. We don't have a paywall. Every investigation is free to access because that's the point, verified information only works if anyone can reach it. If that matters to you, support the work.
