Leaked Information Analysis
Whether information said to be out is real, and yours
We check, on evidence, whether information said to be circulating outside is real, and whether it is really yours.
We look outside, including on the dark web, for staff logins and passwords, customer data, and signs that your company is being mentioned or your data traded. We establish, with the evidence, where and when the information first appeared, whether it is an old leak circulating again and whether it is really yours, and we keep confirmed facts apart from assumptions.
Is the information said to be out there real, and is it really ours?
We establish where and when it appeared and whether it is really yours, with the evidence, keep facts apart from assumptions, and set out what to act on first.
Reviewed
When it fits
- You have had a tip about a leak
You've had a tip that staff credentials or customer data are out, and want to know first whether it is true and whether it concerns you.
- Your name is coming up outside
You've heard your company's name came up on the dark web, or that your data is being traded, and want to know what has been posted, and where.
- You are concerned about staff accounts
You want to know whether staff logins and passwords have leaked, and whether any of them are still in use.
- You need to explain the situation
You want to explain what is going on to management or customers from evidence, with sources and timing and with facts kept apart from assumptions, rather than from rumour.
What we look at
Alongside the information itself, we look at where and when it appeared and whether it is really yours.
Information exposed
- Staff logins and passwords
- Customer data
- Internal documents and business files
- Access keys and credentials for systems
Where it appears
- Dark web forums and sale listings
- Places where leaked data is published
- Messaging channels and online communities
- Posts that mention your company
What we establish
- Where and when it first appeared
- Whether it is an old leak posted again
- Whether it is really yours, and the evidence
- Whether it includes accounts still in use
A post offering “customer data for sale” may turn out to be another company's leak from years ago, posted again; or only some of the accounts in a list of staff logins may still be in use.
How it runs
Agree targets and sources
We agree the company and brand names, the domains, the kinds of information to look for and the sources to use, and start from any tip you have received.
Find and trace
We look for relevant signs in external sources, including the dark web, and trace the same data back to where and when it first appeared.
Check relevance
With your staff we check whether it is really yours and whether it includes accounts still in use, and separate confirmed facts from assumptions.
Report
We explain the source and timing, the evidence of relevance, and what to check and act on first.
A specific tip or signal can be followed as an in-depth investigation; to keep watching for your name and accounts, it can run as monitoring at an agreed interval. See the three ways to run it
What you receive
Source and timing
Where and when the information first appeared, and whether it has been posted again, with the evidence.
Whether it is yours, and why
Whether it is really your information, and whether it includes accounts still in use, with the evidence.
Facts kept apart from assumptions
Confirmed facts are separated from assumptions, and the limits of the information and what still needs checking are stated.
What to check and act on first
Based on the likely impact, what to do first, such as which accounts need their passwords changed.
This analysis checks whether information is already out; it is not an investigation into when or how a breach happened. How information could leak is looked at in Privacy Risk Analysis.