Request demo

Data Leak Detection

Find Your Leaked Data Before Someone Uses It.

A leak has two ends: the door the data got out through, and the leak site, paste or market listing where it shows up. Cyber Threat Intelligence reads the places leaked data appears, and External Attack Surface Management finds the open doors on your surface.

Request demo

Where it shows up

  • leak site post · email domain acme.examplesample: confirm against what you hold 203.0.113.52 · database port answering
    1. Confirm
    2. Scope · data types

Where it got out

  • www.acme.example
  • mail.acme.example
  • 203.0.113.52 · database port answeringraised as an EASM issue
  • shop.acme.example

Close: fix the exposure, rotate what leaked

Leaks Are Found by Whoever Looks First.

Leaked data doesn’t announce itself to its owner. The question is whether your team or someone else reads it first.

No notice

Nobody Tells the Victim

A dump posted to a leak or paste site comes without a notification. Whoever finds it first decides what happens next.

Third parties

Your Data, Their Breach

Records you shared with a supplier leak with the supplier’s data, under the supplier’s name.

Open doors

Services Left Exposed

A database or file-sharing port answering on a public IP address needs no stolen password at all.

Identifiers That Point to Your Data.

A leak rarely names its owner in the title. These identifiers give it away, and each one is matched in a specific place.

IdentifierWhy it mattersMatched in
Email domainStaff or customer addresses in a dumpDark web index, breach data
Brand and product namesA dump or listing named after youDark web index, free text
Internal codenamesProject names that appear only in your own documentsDark web index, free text
Website mentionsPages that name one of your sitesDark web index
Card and ID numbersPayment cards and Social Security numbers in leaked dataDark web index, payment credentials
Named leaksPosts tied to a specific leakDark web index

title

Leak site post

its title names no one · a sample, to check against what you hold

  1. Brand and product namesdark web index, free text

    [About]a dump of Acme

  2. [Sample]the first lines of the dump

  3. Email domaindark web index, breach data

    emailj.@acme.example

  4. Card and ID numbersdark web index, payment credentials

    card

  5. Website mentionsdark web index

    urlhttps://shop.acme.example/

  6. Internal codenamesdark web index, free text

    refproject

The title names no one; the identifiers do, each matched where it lives.

Confirmagainst what you hold

See Where It Surfaced and Where It Started.

Cyber Threat Intelligence reads where data surfaces. External Attack Surface Management covers where it gets out.

Dark Web Mentions Monitoring

Watches the dark web index for your domains and your brand and product names, with each mention’s source and context.

CTI

Dark Web Search

Queries by indicator when a leak is suspected: your email domain, a website mention, card numbers, Social Security numbers or a named data leak.

CTI

Data Breach Index

Breaches that include your addresses, with the data types each one exposed, so scoping starts from a record instead of a guess.

CTI

Compromised Client Credential Monitoring

Your customers’ logins to your services, found in leaked credential data and kept open until your team closes them.

CTI

Risk Detection

Raises exposed services, such as database or file-sharing ports on public IPs, and login pages reachable from the internet, as issues with evidence.

EASM

Confirm the Leak, Then Find the Door.

  1. 01

    Watch

    Put your email domains and brand names under mentions monitoring. Search by free text for internal codenames when a leak is suspected.

  2. 02

    Confirm

    Open the hit where it was found and check the sample against what you hold before anyone calls it a breach.

  3. 03

    Scope

    Use the breach record’s data types and account counts, and search for the other indicators on that page.

  4. 04

    Trace

    Look for the way out on your surface: exposed services, public login pages, recent DNS or certificate changes.

  5. 05

    Close

    Fix the exposure, rotate what leaked, and keep the issue’s state history for the incident record.

After the Leak Is Confirmed.

Use case Dark Web Monitoring Where leaked data appears, searched and watched. Read Use case Credential Exposure Management When the leak is logins, cards or breached addresses. Read Use case Incident Investigation and Response Pivot from the leak to the infrastructure around it. Read

Questions About Data Leak Detection

What kinds of leaks can the Deepinfo Platform find?

Data that appears in the sources Deepinfo indexes: leak sites, paste sites, markets, forums, chats and breach data. It finds them by the identifiers you give it and by the indicators it extracts from each page, such as email addresses, card numbers and website mentions.

Does this replace data loss prevention?

No. Data loss prevention works inside your network, on data in motion. This workflow looks outside: where leaked data appears, and which of your internet-facing services could let it out.

Which leak signals can trigger an alert?

A new email breach that includes your addresses, and a newly open port on one of your monitored assets, are both notification events. A rule emails the team members it names, instantly or as a digest.

Can we see when a service was first exposed?

For assets you monitor, yes. Each scanned layer keeps dated snapshots, so the port scan or web data from an earlier date can be opened next to today’s. That history starts when the asset joins monitoring.

What if the leak came from a supplier?

Search for the supplier’s email domain and names as you would for yours. If the supplier runs as a Third-Party Risk Management portfolio, its exposed services are already being scanned.

Find Out Whether Your Data Has Already Leaked.

Book a demo and we’ll scope monitoring to your domains and brand names with your team.

Request demo