# Data Leak Detection

URL: https://www.deepinfo.com/solutions/use-cases/data-leak-detection/

## Find Your Leaked Data Before Someone Uses It.

A leak has two ends: the door the data got out through, and the leak site, paste or market listing where it shows up. [Cyber Threat Intelligence](https://www.deepinfo.com/platform/cti/) reads the places leaked data appears, and [External Attack Surface Management](https://www.deepinfo.com/platform/easm/) finds the open doors on your surface.

[Request demo](https://www.deepinfo.com/request-demo/)

### Leaks Are Found by Whoever Looks First.

Leaked data doesn’t announce itself to its owner. The question is whether your team or someone else reads it first.

No notice

#### Nobody Tells the Victim

A dump posted to a leak or paste site comes without a notification. Whoever finds it first decides what happens next.

Third parties

#### Your Data, Their Breach

Records you shared with a supplier leak with the supplier’s data, under the supplier’s name.

Open doors

#### Services Left Exposed

A database or file-sharing port answering on a public IP address needs no stolen password at all.

### Identifiers That Point to Your Data.

A leak rarely names its owner in the title. These identifiers give it away, and each one is matched in a specific place.

| Identifier | Why it matters | Matched in |
| --- | --- | --- |
| Email domain | Staff or customer addresses in a dump | Dark web index, breach data |
| Brand and product names | A dump or listing named after you | Dark web index, free text |
| Internal codenames | Project names that appear only in your own documents | Dark web index, free text |
| Website mentions | Pages that name one of your sites | Dark web index |
| Card and ID numbers | Payment cards and Social Security numbers in leaked data | Dark web index, payment credentials |
| Named leaks | Posts tied to a specific leak | Dark web index |

### See Where It Surfaced and Where It Started.

Cyber Threat Intelligence reads where data surfaces. External Attack Surface Management covers where it gets out.

#### [Dark Web Mentions Monitoring](https://www.deepinfo.com/platform/cti/dark-web-mentions-monitoring/)

Watches the dark web index for your domains and your brand and product names, with each mention’s source and context.

#### [Dark Web Search](https://www.deepinfo.com/platform/cti/dark-web-search/)

Queries by indicator when a leak is suspected: your email domain, a website mention, card numbers, Social Security numbers or a named data leak.

#### [Data Breach Index](https://www.deepinfo.com/platform/cti/data-breach-index/)

Breaches that include your addresses, with the data types each one exposed, so scoping starts from a record instead of a guess.

#### [Compromised Client Credential Monitoring](https://www.deepinfo.com/platform/cti/compromised-client-credential-monitoring/)

Your customers’ logins to your services, found in leaked credential data and kept open until your team closes them.

#### [Risk Detection](https://www.deepinfo.com/platform/easm/comprehensive-risk-detection/)

Raises exposed services, such as database or file-sharing ports on public IPs, and login pages reachable from the internet, as issues with evidence.

### Confirm the Leak, Then Find the Door.

1. **Watch**

   Put your email domains and brand names under mentions monitoring. Search by free text for internal codenames when a leak is suspected.
2. **Confirm**

   Open the hit where it was found and check the sample against what you hold before anyone calls it a breach.
3. **Scope**

   Use the breach record’s data types and account counts, and search for the other indicators on that page.
4. **Trace**

   Look for the way out on your surface: exposed services, public login pages, recent DNS or certificate changes.
5. **Close**

   Fix the exposure, rotate what leaked, and keep the issue’s state history for the incident record.

### After the Leak Is Confirmed.

- [Dark Web Monitoring](https://www.deepinfo.com/solutions/use-cases/dark-web-monitoring/) (Use case): Where leaked data appears, searched and watched.
- [Credential Exposure Management](https://www.deepinfo.com/solutions/use-cases/credential-exposure-management/) (Use case): When the leak is logins, cards or breached addresses.
- [Incident Investigation and Response](https://www.deepinfo.com/solutions/use-cases/incident-investigation-and-response/) (Use case): Pivot from the leak to the infrastructure around it.

### Questions About Data Leak Detection

**What kinds of leaks can the Deepinfo Platform find?**

Data that appears in the sources Deepinfo indexes: leak sites, paste sites, markets, forums, chats and breach data. It finds them by the identifiers you give it and by the indicators it extracts from each page, such as email addresses, card numbers and website mentions.

**Does this replace data loss prevention?**

No. Data loss prevention works inside your network, on data in motion. This workflow looks outside: where leaked data appears, and which of your internet-facing services could let it out.

**Which leak signals can trigger an alert?**

A new email breach that includes your addresses, and a newly open port on one of your monitored assets, are both notification events. A rule emails the team members it names, instantly or as a digest.

**Can we see when a service was first exposed?**

For assets you monitor, yes. Each scanned layer keeps dated snapshots, so the port scan or web data from an earlier date can be opened next to today’s. That history starts when the asset joins monitoring.

**What if the leak came from a supplier?**

Search for the supplier’s email domain and names as you would for yours. If the supplier runs as a [Third-Party Risk Management](https://www.deepinfo.com/platform/tprm/) portfolio, its exposed services are already being scanned.

### Find Out Whether Your Data Has Already Leaked.

Book a demo and we’ll scope monitoring to your domains and brand names with your team.

[Request demo](https://www.deepinfo.com/request-demo/)