Data leak: what should I do?

Check first, then report. Leak-Ingest shows whether your domain appears on a leak site. Once you approve, it downloads the data, finds the people affected and proposes an assessment. From there you create the data breach in SecTepe.Core. The data protection module works out deadlines and the duty to report. In parallel, your IT team handles the leaked credentials.

Am I allowed to download leaked data at all?

You need to check this legally before you start. We do not give legal advice. The module makes sure the decision is deliberate: without an approval for your domain, there is no download. The approval, its revocation and every access go into the audit log. The case file lists the approval as its first basis.

Who can see the data?

Leak management is open to tenant admins only, usually the data protection officer. Search results first show only who is affected and in which column. An admin opens the actual content of a record one at a time, and that is logged. Employees only see hits for their own addresses.

How long is the data kept?

As long as you decide. There is no default on purpose. You set one period each for files, index and case file, and you write down why. The case file may not expire before the data. The module flags any period that has run out. Data is deleted on your instruction, with a receipt.

Which reporting duties does Leak-Ingest support?

Reporting a data breach under Art. 33 GDPR and notifying people under Art. 34. It also helps with access requests under Art. 15: you search for one person across all datasets. There is no separate workflow for NIS2 reports. The case file still gives your team the facts it needs for one.

What happens to leaked passwords?

The module never shows a password and never returns one through its API. You see which account and which system are affected, and whether the password is in plain text or hashed. Your IT team changes it and records the result. Every marking is logged.

All products

Data leak & data breach

SecTepe Leak-Ingest– find, assess and report leaked data

After a ransomware attack, your data often ends up on a leak site on the dark web. Leak-Ingest spots this. Once you approve, it downloads the data, finds the people affected and prepares your report.

Request a demo

At a glance

Daily check against leak site victim lists
Download only after approval per domain
Affected people found in your own registers
Assessment and case file for Art. 33 and 34 GDPR
Worklist for leaked passwords, no plain text
Retention, deletion with receipt, audit log

Data leak on the dark web: know what is out there

Many ransomware groups steal data before they encrypt it. If the victim does not pay, they put the data on a leak site. Then the clock starts. Under Art. 33 GDPR, you report a data breach within 72 hours of becoming aware of it.

To report, you need facts. Who is affected? Which types of data? Are passwords included? Leak-Ingest answers these questions from the leaked data itself. SecTepe built the module in-house. It is part of SecTepe.Core.

Features at a glance

From the first hint to the deleted copy: what the module does for your team.

Dark web monitoring of leak sites

Once a day, the module checks the victim lists of leak sites for your domains and your company name. Hits go to your data protection officer as candidates. Nothing is downloaded at this stage.

Download only with approval

A download starts only if an active approval covers the affected domain. An admin grants it per domain, with a case reference if needed. Revoking it stops further downloads.

Matched against your registers

The module checks who in the leak belongs to you: users, monitored addresses, the GDPR data subject register and supplier contacts. A name alone counts as a hint, not a match.

Assessment for Art. 33 and 34

You get a proposal: how many people, which data categories, which evidence. You decide yourself whether special categories under Art. 9 or criminal data under Art. 10 are involved.

Work through leaked passwords

Found credentials appear as a worklist, yours first. You see the account and the system, never the password itself. You mark each entry as tested, valid, invalid or changed.

Retention and proof of deletion

You set one period each for files, index and case file, always with a reason. The module shows when a period has run out. Every deletion creates a receipt that is kept.

Checking a data leak: how a case runs

Hint: The daily check finds your domain or company name in a victim list. A domain counts as a strong match, the name as a medium one. Sector or country alone do not count.
Approval: Your data protection officer decides whether the data is fetched. They approve the domain and start the download on purpose.
First look: If you like, you first save only the leak site's file list. You can also fetch only the files that may hold credentials. This partial dataset is marked as incomplete.
Download and index: A separate service of SecTepe Threat Intelligence runs the download, apart from SecTepe.Core. It indexes the files. You watch progress live, and you see it when a run stalls.
Matching: The module marks which people in the leak are yours. It checks companies against your organisation and supplier registers, and systems against your asset register.
Assessment: You get a proposal for Art. 33 and 34 with the number of people and the data categories. If the index is not finished, the numbers are marked as a minimum.
Report: One click creates the data breach in the data protection module. It works out risk, duty to report and deadlines. A second click does not create a second report.
People affected: You review each person and record when and how you informed them, for example by letter or email. The module records the notice. It does not send it.
Closing: Your IT team changes the leaked credentials. When the period ends, you delete files and index. The case file holds everything for the supervisory authority.

Is the leak site offline, or would the download take too long? Then your on-site Collector can supply the listed files from your own servers. Every assessment then states first that these are your own copies, not the attacker's data.

Privacy built in: roles, audit, deletion

A leak holds other people's data. So every step is tightly limited and traceable.

Admins only: Leak management is open to tenant admins only, usually the data protection officer.
Tenant isolation: Every query is limited to your tenant. The system answers a foreign ID with "not found".
Metadata first: Search shows who is affected and where. An admin opens the content of a record one at a time.
Audit log: Approvals, searches, record views, exports and deletions are logged. A CSV export of the affected list is logged before it starts. IBANs in it are masked.
Periods with reasons: You cannot save a retention period without a reason.
Proof of deletion: Once the index is deleted, the module blacks out personal details in the affected list. What you did stays provable.

The case file lists open questions first. If an active approval is missing, that is at the top. So a file with gaps never looks complete. Whether you may obtain and store leaked data is something to settle with your legal and data protection advisers first. The module records your decision. It does not replace it.

Part of SecTepe.Core

Leak-Ingest is a SecTepe.Core module. It uses the registers Core already keeps: users, data subjects, suppliers and assets. The data breach is created directly in the data protection module.

Download and indexing run inSecTepe.Core threat intelligence. It also supplies the victim lists fordark web monitoring. Our article onevaluating ransomware leaks under the GDPRexplains how the data is read in.

Leaked passwords invitecredential stuffing. If your team needs help, ourincident response team steps in. If your company falls under the NIS2 directive, use the facts from the case file for that report too.

My Leaks: self-service for employees

Each person sees hits for their own addresses only, never anyone else's.
Up to five private addresses can be added, each confirmed by double opt-in.
Only metadata is shown, such as "password affected", never the secret itself.

Features in detail

GDPR data breach notification

A proposal with people and data categories, the breach record in the data protection module, notification and case file.

Work through leaked credentials

A worklist for the accesses found, yours first, without ever showing a password.

My Leaks for employees

Each person checks their own addresses, private ones only after double opt-in.

FAQ on data leaks and data breaches

Data leak: what should I do?: Check first, then report. Leak-Ingest shows whether your domain appears on a leak site. Once you approve, it downloads the data, finds the people affected and proposes an assessment. From there you create the data breach in SecTepe.Core. The data protection module works out deadlines and the duty to report. In parallel, your IT team handles the leaked credentials.
Am I allowed to download leaked data at all?: You need to check this legally before you start. We do not give legal advice. The module makes sure the decision is deliberate: without an approval for your domain, there is no download. The approval, its revocation and every access go into the audit log. The case file lists the approval as its first basis.
Who can see the data?: Leak management is open to tenant admins only, usually the data protection officer. Search results first show only who is affected and in which column. An admin opens the actual content of a record one at a time, and that is logged. Employees only see hits for their own addresses.
How long is the data kept?: As long as you decide. There is no default on purpose. You set one period each for files, index and case file, and you write down why. The case file may not expire before the data. The module flags any period that has run out. Data is deleted on your instruction, with a receipt.
Which reporting duties does Leak-Ingest support?: Reporting a data breach under Art. 33 GDPR and notifying people under Art. 34. It also helps with access requests under Art. 15: you search for one person across all datasets. There is no separate workflow for NIS2 reports. The case file still gives your team the facts it needs for one.
What happens to leaked passwords?: The module never shows a password and never returns one through its API. You see which account and which system are affected, and whether the password is in plain text or hashed. Your IT team changes it and records the result. Every marking is logged.

Report a data breach with solid numbers

We walk you through a case from approval to case file and clarify what you need for it.

Request a demo All products

How we work with you

We want to work with you for the long run, not just deliver once. Our way of working has four steps. So you always know what comes next, who does what and what you get.

1. Free initial conversation

We learn where you stand and what you want. In 30 to 45 minutes we check if we are a good fit. We show you options and answer your questions. There is no obligation.

2. Current state review

We check where you stand today: tech, processes and rules. You get a list of strengths and gaps, sorted by urgency. Our offer is based on it.

3. Delivery with a dedicated lead

An experienced lead guides you through the project. You get clear goals, an open plan for time and cost, and a status every week. All results are written down and belong to you.

4. Running and reviewing

After the project we stay with you. We run systems for you, check them at set times and keep track of open tasks. When new threats or new rules come up, we get in touch.