Data interception and theft: meaning and protection

Most data theft you hear about is a break-in: someone gets into a company's database and takes a copy. Interception is different. The attacker never touches the database. They sit in the path of the data while it moves, and read it on the way past.

NIST, the US standards body, describes the best-known form, the man-in-the-middle attack, as one where an attacker is positioned between two communicating parties in order to intercept and/or alter the data traveling between them. Neither side sees anything wrong, because the messages still arrive.

Where it happens

The classic setting is public Wi-Fi. If you join a fake network called something like "Airport_Free_WiFi", or a real one with weak protection, whoever runs it can see traffic that isn't encrypted. Other routes include a compromised home router, a fake website that passes your login through to the real one, and malicious software on your own device that reads what you type.

What gets taken

Whatever you send while the attacker is watching: login details, card numbers, messages, session cookies that keep you signed in. An intercepted login or session can lead straight to account takeover, and the personal details inside an account (address, phone number, date of birth) can end up in the same places stolen data usually goes.

Interception vs. a data breach

A data breach is a company losing data it stores. Interception is data taken from you or from a connection while it is moving. Both can feed identity theft, but with interception the fix is usually on your side: how you connect and what you sign in on.

Modern websites encrypt traffic with HTTPS, which makes casual interception much harder. It still happens when people click through browser warnings, use untrusted networks, or have malware on their device.

How to protect yourself

Treat public Wi-Fi as untrusted

Avoid logging in to banking, email or shopping on a network you can't vouch for. Use your phone's mobile data instead, or a VPN from a provider you trust.

Don't click through certificate warnings

If your browser warns that a site's certificate is invalid or the connection isn't private, stop. That warning is often the only visible sign of interception.

Turn on two-step verification

With a second factor, a stolen password alone is not enough to get into your account. An authenticator app or security key is stronger than text messages.

Keep devices and routers updated

Install updates for your phone, computer and home router, and change the router's default admin password. Malware and compromised routers are common ways to sit in the middle of your traffic.

Cut down what an attacker could find about you

Stolen logins are more useful to someone who can also look up your address and phone number. Serus finds where that information is listed and removes it.

Frequently asked

Is data interception illegal?

In most countries, intercepting someone else's communications without permission is a crime, though the exact laws differ. If you think it happened to you, report it to your local police or national cybercrime reporting service.

How can I tell if my data was intercepted?

Often you can't tell directly. Warning signs include browser certificate warnings, being logged out unexpectedly, and account activity or password reset emails you didn't start. If you see them, change your passwords from a trusted network and check your account's sign-in history.

Does a VPN stop data interception?

A VPN encrypts traffic between your device and the VPN provider, which helps on untrusted networks. It doesn't protect you from malware on your device or from a phishing site you type your password into.

What is data interception and theft?