Leaked and breached data review
Look for evidence that company accounts, documents or identifiers appear in relevant public and lawfully accessible breach sources. Give the client enough context to triage a credible match without redistributing exposed data.
Is this exposed identifier current, historical or a duplicate?
A historical breach collection includes a masked corporate identifier. The record alone does not establish account access.
Illustrative investigation record
- Source and confidence
- Record the source date, masked identifier, confidence in the domain match and uncertainty about account status.
- Owner check
- The identity team checks account history and whether it already recorded the exposure.
- Decision
- Close a verified historical duplicate or refer newly corroborated evidence to the client’s internal investigation process.
When to choose this service
- A supplier has disclosed an incident or a staff member receives a credible exposure alert.
- An acquired brand used legacy domains that still appear in older records.
- You need to establish which reported records belong to your business before starting containment.
Agree the domains, aliases, identifiers and permitted evidence sources. Review accessible breach records, exposed material and relevant indexed dark-web sources where available. Correlate records with client-held information and distinguish a new disclosure from a duplicate or historical collection.
What we examine
- Whether records match an agreed organisational identifier and whether the underlying source and date can be established.
- What type of information appears exposed: account identifiers, credential material or business documents.
- Signs of repeated credential exposure across records, using minimal evidence and prioritising current, sensitive or privileged accounts for client validation.
Illustrative finding
Example scenario: an old corporate email address appears in a third-party breach collection. The security team confirms whether the account still exists, reviews recent access and decides on password or session changes. The record alone does not show that the corporate account was accessed.
What to prepare
- Authorised domains and aliases, ownership context and incident escalation contacts.
- Permitted data categories, evidence retention and redaction rules, and the client’s secure handover method.
- An account or data owner who can verify current status and take approved containment actions.
Agreed boundaries
Coverage depends on lawful source access and availability. Records can be stale, duplicated, altered or incorrectly attributed. A match does not prove the current password works, a live compromise occurred or the original breach happened at the client. Do not test exposed credentials against live services or return cleartext secrets as routine evidence.
What you receive
Receive a minimised exposure register with masked identifiers, source and date where known, confidence, potential impact and recommended action. Priorities may include account review, credential rotation, session revocation or separate incident investigation. The client owns business, privacy and notification decisions.
Follow-up
A follow-up can review newly available sources or whether the client’s actions were completed. Historical copies of leaked data may persist.
Tell us the business question, the systems or sites involved and the decision that depends on the result.
Discuss an exposure review