When a company's data appears on a ransomware leak site, the affected organization must answer four questions – quickly and robustly: Who is affected? Which credentials are now open? What else is in there? And: does a particular term appear anywhere? The leak ingest module in SecTepe.Core.CTI answers exactly these questions – and does so along clearly drawn GDPR lines.
GDPR Here Is Not an Add-On but the Framework
The module supports the affected organization's notification duties under Art. 33 GDPR (72-hour notification to the supervisory authority) and Art. 34 GDPR (notification of data subjects). SecTepe acts as a processor under Art. 28 GDPR. Special categories of personal data under Art. 9 are detected and counted, the rotation list for credentials rests on Art. 32(1)(b) and Art. 34(3)(a), and search logging serves the accountability principle under Art. 5(2).
Hard Security Gates by Design
- Opt-in per (tenant, victim domain): without explicit grant the status stays
refused– nothing is downloaded. - Outbound only over Tor, only
.onion: a clearnet URL leads to HTTP 400. - ClamAV scan before extraction: infected files are quarantined and never unpacked or executed; plus a zip-bomb cap and a 10 MiB per-file limit.
- Encrypted object store: stored in MinIO, strictly separated by
leaks/<tenant>/<dataset>/….
Detect Credentials Without Exporting Them
Credentials are detected in three tracks – from columns (password, hash, API key), from text (stealer logs, connection strings, PEM blocks, AWS keys), and from files (.kdbx, id_rsa, .ovpn, .env). Crucially: the secret value itself never leaves the detection module. Only the username, target system, the form of the secret, and the location are passed on – enough to rotate without re-exposing the secret.
Tenant-Wide Keyword Search With Confidence Tiers
Via POST /api/v1/leak-records/search the entire holdings of a tenant can be searched – with confidence tiers high (whole word in a column/identifier), medium (substring), and low (snippet or filename only). Hits name matched_keywords and matched_fields (column names, never values) – so the interface can show why a record matched without disclosing the content.
OCR, SQL Dumps, Recurrence, and Provable Deletion
The module also reads text out of images (OCR), interprets SQL dumps as tables with join relationships (including a confidence statement), recognizes the same person across multiple incidents, and offers provable deletion in three tiers. The bilingual victim warning report (Markdown, JSON, and PDF) is generated exclusively from file metadata – never from leaked content.
Conclusion
Leak ingest turns a ransomware leak into a controlled, GDPR-compliant evaluation process: opt-in, Tor only, ClamAV first, credentials without clear text, search with proof, and provable deletion. The results flow into the leak dataset module of SecTepe.Core – from the raw file to a reportable statement.