When a company's data shows up on a ransomware leak site, the company must answer four questions. It must answer them fast, and the answers must hold up:
- Who is affected?
- Which credentials are now exposed?
- What else is in the data?
- Does a certain term show up anywhere?
The leak ingest module in SecTepe.Core.CTI answers exactly these questions. It works within clearly drawn GDPR limits.
Here, GDPR Is Not an Add-On but the Framework
The module helps the affected company meet its duty to notify:
- Art. 33 GDPR: notify the supervisory authority within 72 hours.
- Art. 34 GDPR: inform the data subjects.
SecTepe acts as a processor under Art. 28 GDPR. The module detects and counts special categories of personal data under Art. 9. The rotation list for credentials is based on Art. 32(1)(b) and Art. 34(3)(a). Search logs support the accountability principle under Art. 5(2).
Hard Security Gates by Design
- Opt-in per (tenant, victim domain): without an explicit grant, the status stays
refused. Nothing is downloaded. - Outbound only over Tor, only
.onion: a clearnet URL returns HTTP 400. - ClamAV scan before extraction: infected files go to quarantine. They are never unpacked or run. A zip-bomb cap and a 10 MiB limit per file add more safety.
- Encrypted object store: data is stored in MinIO and kept strictly apart by
leaks/<tenant>/<dataset>/….
Find Credentials Without Exporting Them
The module looks for credentials in three places:
- columns: password, hash, API key,
- text: stealer logs, connection strings, PEM blocks, AWS keys,
- files:
.kdbx,id_rsa,.ovpn,.env.
The key point: the secret value itself never leaves the detection module. Only the username, the target system, the form of the secret and where it was found are passed on. That is enough to rotate the secret without exposing it again.
Keyword Search Across the Tenant, With Confidence Tiers
With POST /api/v1/leak-records/search you can search all data a tenant holds. Each hit has a confidence tier:
high: whole word in a column or identifier,medium: substring,low: only in a snippet or file name.
Hits list matched_keywords and matched_fields. These are column names, never values. So the interface can show why a record matched without revealing its content.
OCR, SQL Dumps, Repeat Victims and Provable Deletion
The module can do more:
- It reads text from images (OCR).
- It reads SQL dumps as tables with join relations, including a confidence statement.
- It spots the same person across several incidents.
- It offers provable deletion in three tiers.
The bilingual victim warning report (Markdown, JSON and PDF) is built only from file metadata. It is never built from leaked content.
Conclusion
Leak ingest turns a ransomware leak into a controlled, GDPR-compliant review: opt-in, Tor only, ClamAV first, credentials without clear text, search with proof and provable deletion. The results flow into the leak dataset module of SecTepe.Core. That takes you from the raw file to a statement you can report.