Cyber Threat Intelligence and Digital Risk Protection
Data Leak Monitoring
We monitor if your organization's passwords, session data and documents are circulating externally. For each confirmed record, we recommend reset and investigation steps.
What it is
Corporate credentials typically leak in two ways: when employees reuse passwords that are leaked from other sites, or when infostealer malware collects passwords and session cookies from devices. This service matches such records to your domains and assesses whether they are still valid.
Scope
- Searching leak records for accounts on your corporate domains
- Tracking corporate session, VPN and SaaS credentials in infostealer logs
- Searching public code repositories for your organization's keys and passwords
- Assessing whether documents and datasets published or offered for sale belong to your organization
- Password reset, session revocation and device review recommendation for each confirmed record
The need
When organizations need it
- When you receive notice that passwords for your corporate accounts appear in a leak list.
- When a ransomware group claims to have obtained data from your organization.
- When a supplier experiences a data breach and you need to know which of your data is affected.
Method
How we work
-
Matching
We add your domains, email formats and critical applications to the watch list.
-
Assessment
We assess each record's date, source and current validity.
-
Recommendation
For each confirmed record, we recommend a password reset, session revocation or device review.
-
Decision support
We summarize the findings to support your decision on whether to initiate a breach investigation.
Outcome
What you have at the end
You receive corporate account and data records found externally, each assessed for validity. Every record has a defined next step and responsible party.
Frequently asked questions
Does a leak record mean we have been breached?
No. A single record is not a confirmed breach. It may be outdated or originate from another site. It helps you decide whether to initiate a breach investigation.
We use multi-factor authentication. Is there still a risk?
Yes. Infostealer malware can also collect session cookies. With a valid session cookie, multi-factor authentication can be bypassed. Therefore, session revocation is recommended along with password reset.
Do we have to notify a data protection authority?
If personal data has been obtained by others, data protection law generally requires notification to the authority promptly. Under GDPR, for example, this means without undue delay and, where feasible, within 72 hours. We recommend assessing with your legal counsel whether a record falls into this category.
Cyber Threat Intelligence and Digital Risk Protection
Other services in this area
Let's talk about this service.
Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.
Schedule a Meeting