I used special emails for my kids’ savings accounts at a major brokerage, and then started getting weird emails to one of them. This was on a private domain and the addresses weren’t really guessable, so that’s how I knew they had been breached before they announced it weeks or months later.