Lesson 5.10

Breach & Leak Data

Learning Objectives

Distinguish data breaches, combolists, stealer logs, and paste-site leaks
Use Have I Been Pwned correctly, including its domain search rules
Compare commercial breach search services and understand their legal and ethical gray areas
Apply the “check ≠ download ≠ use” rule
Handle sensitive breach results safely in notes and reports

Why Breach Data Matters

Billions of account records have leaked over the years. For OSINT, breach data answers questions like:
- Has this email address been exposed, and in which services?
- Which services does this person (or company) use? (A breach of a fitness app, gaming site, or forum reveals interests and accounts.)
- Are employee credentials circulating, meaning the organization is at risk of account takeover?

Breach data is also where OSINT is most likely to cross legal and ethical lines, so this topic always comes with rules.

Types of Leaked Data

Type	What it is	Why it matters
Data breach	Data stolen from one organization (e.g., a website’s user database)	Often includes emails, usernames, password hashes, sometimes addresses and phone numbers
Combolist	Username/password pairs compiled from many breaches, used for credential stuffing (trying leaked passwords on other sites)	Shows password reuse risk
Stealer logs	Data taken from an individual’s infected computer by infostealer malware: saved passwords, browser cookies, session tokens, system info	Very current and dangerous; session tokens can let attackers skip MFA. See Module 6.
Paste-site leaks	Data dumped on Pastebin-style sites	Often small samples or advertisements for larger dumps
Ransomware leaks	Files stolen from an organization and published on a leak site when it refuses to pay	Can include internal documents, HR records, and customer data

Have I Been Pwned (HIBP)

What it is: A free service run by security researcher Troy Hunt that lets you check whether an email address appears in known data breaches. It’s the safest, most widely accepted breach lookup and is the right starting point for students.

What it shows: Which breaches an email appeared in, when each breach happened, and what data types were exposed (emails, passwords, IP addresses, and so on). It does not show the actual passwords.

Key features:
- Email search: Free, no account needed.
- Notify me: Free alerts if your email shows up in a future breach.
- Sensitive breaches: Some breaches (e.g., from adult sites) aren’t shown in public searches; only the verified owner of the address can see them. This is a good example of ethical design.
- Pwned Passwords: Checks whether a password has appeared in breaches. The API uses a k-anonymity model: you send only the first 5 characters of the password’s SHA-1 hash, so the service never learns the full password. Many password managers use this.
- Domain search: Lets an organization see all breached addresses on its domain.
- You must prove ownership or control of the domain first.
- Most domain searches are free, but once a domain has more than 10 breached email addresses, searching it requires a paid subscription (a policy since August 2023).
- The Core plans are for monitoring domains you control yourself and don’t permit use on behalf of third parties. The Pro plans support monitoring customer domains (for MSPs and consultants). Check the current subscription page for pricing.

Teaching point: HIBP’s domain verification is a built-in version of our class rule: only search what you’re authorized to search.

Attacker use: Confirming that a target’s email exists and seeing which services they use, to pick credential-stuffing targets.
Defender use: Monitoring company domains, prompting password resets, and security awareness (“here’s where your data leaked”).

Commercial Breach Search Services

These services go further than HIBP. Some return the actual leaked records, including passwords. That power is why they’re a legal and ethical gray area.

Service	What it searches	Access & cost	Notes
DeHashed	Breach records by email, username, IP, name, phone, password hash, and more	Limited free search; paid credits and subscriptions (third-party sources list pricing from about $0.02 per query); API requires paid credits	Popular with pentesters and investigators; results can include plaintext or hashed passwords
Intelligence X (intelx.io)	Data leaks, paste sites, Tor and I2P content, WHOIS, and historical internet data (it claims 200B+ records)	Free account with very limited results; paid tiers are expensive (the Researcher tier reportedly starts around €2,500/year)	Also archives content that has since been deleted
Hudson Rock (hudsonrock.com, infostealers.com)	Infostealer infections tied to an email, username, or domain	Free lookups; a free account monitors up to 3 emails, 3 domains, and 3 usernames; free community API; deeper data is paid	Focused on stealer logs (see Module 6)
SOCRadar Dark Web Report	Domain-level scan of breach records, forums, stealer logs, and threat actor channels	Free, no account required (per SOCRadar)	Intended for organizations checking their own domain
XposedOrNot	Free breach lookup and API (verify before class)	Free with paid add-ons (verify before class)	Community alternative to HIBP

Before using any commercial service:
1. Read the Terms of Service. Many require that you only search yourself or your organization.
2. Check your authorization. On an engagement, is breach data searching in scope? Get it in writing.
3. Consider jurisdiction. In some places and contexts, possessing or trading stolen personal data can itself create legal exposure.
4. Consider OPSEC. Your searches are visible to the service.

Ransomware Trackers

When ransomware gangs publish victims on their leak sites, trackers record those listings so researchers don’t have to visit criminal sites.

ransomware.live: Monitors ransomware leak sites and tracks victims (organization name, responsible group, country, discovery date), with statistics on hundreds of active groups.
RansomLook: Open-source platform tracking hundreds of ransomware groups, markets, and threat actors, including posts, cryptocurrency addresses, ransom notes, and the mirror URLs groups use.

Use cases: Checking whether a vendor or partner has been listed as a victim, tracking which sectors a group targets, and building threat intel reports.

Rule: Use the trackers, not the leak sites. Don’t browse or download from leak sites (legal risk, malware risk, and the files contain real people’s stolen data).

Paste Sites

Paste sites (Pastebin and its many alternatives) let anyone post text anonymously. Attackers use them to share samples of stolen data, advertise dumps, or post configuration files and code.

Most paste sites offer limited or no public full-text search. Researchers typically use search engine queries such as site:pastebin.com "companyx.com" (verify before class for current search options).
Pastes are often deleted quickly, so services that archive them (such as Intelligence X) and monitoring platforms are more reliable than manual searching.
Threat actors have largely moved to Telegram channels and forums (see Module 6), but pastes still show up.

Check ≠ Download ≠ Use

This is the most important rule in this file. Write it on the board.

Action	Example	Acceptable?
Check	“Does my email appear in any breach?” (HIBP)	Yes, for yourself or authorized targets
Download	Grabbing a full breach dump from a forum or torrent	No. Legal risk, malware risk, and it’s stolen personal data about millions of people
Use	Logging in with a leaked password, even “just to see if it works”	Never. That’s unauthorized access (CFAA and similar laws)

Gray zone discussion: Some professional threat intel teams do analyze breach data under legal guidance, to protect their own users. The difference is authorization, purpose, and controls, not curiosity.

Handling Sensitive Results

If breach data shows up in your authorized work:
- Don’t copy plaintext passwords into notes, tickets, chat, or reports. Record that a credential was exposed, where, and when, not the secret itself.
- Redact partial values if you must show evidence (e.g., P@********1).
- Minimize: Record only what the objective requires.
- Secure storage: Encrypted, access-controlled, and deleted at the end of the engagement.
- Act on it: The point is remediation, so trigger password resets and session revocation, and enable MFA.
- Notify appropriately: Follow the client’s process; don’t contact affected individuals on your own.

Key Terms

Data breach: Unauthorized access to and theft of data from an organization.
Combolist: A compiled list of username/password pairs used for credential stuffing.
Credential stuffing: Automatically trying leaked credentials on other sites, which works because people reuse passwords.
Infostealer / stealer log: Malware that harvests credentials and cookies from a victim’s device / the data it produces.
k-anonymity (Pwned Passwords): Checking a password by sending only a short hash prefix so the service never sees the full hash.
Leak site: A ransomware gang’s website for publishing stolen data from victims who don’t pay.

Key Takeaways

Breach data reveals which services people use and whether credentials are exposed
HIBP is the safe starting point; domain search requires proving you control the domain
Commercial breach search can expose real passwords, which makes it a legal and ethical gray area
Use ransomware trackers instead of visiting leak sites
Check ≠ download ≠ use; never log in with leaked credentials
Never put plaintext passwords in notes or reports; record the exposure, not the secret

References

Free to use, copy, change and teach. Security For the Folks dedicates this course to the public domain under CC0 1.0 Universal: no permission or credit needed. Quoted material and the sources it links to belong to their own authors.