Report a data breach with numbers from the leak
Your data is on a leak site. The clock is running. Leak-Ingest gives you the facts for the report. With one click, you create the breach record in the data protection module of SecTepe.Core.
Request a demoThe proposal: people and data categories
Under Art. 33 GDPR, you report within 72 hours. The authority asks: How many people? Which data? How high is the risk? Leak-Ingest counts in the leaked data itself. Before you file, you see a proposal. No record exists yet.
- Number of people: Each person counts once, even if they appear in many files.
- Floor: Rows without an identifier such as an email cannot be tied to a person. So the number is marked as a floor, as is a run still in progress.
- Data categories: Contact data, identity data, financial data and online identifiers such as passwords.
- Accesses: If passwords are in plain text, the proposal points to a high risk under Art. 34. As a first step, it names changing those accesses.
Below it, the module lists what the numbers cannot support.
Art. 9 and Art. 10: your case handler decides
Art. 9 protects special data, such as health data. Art. 10 covers data on criminal offences. The module only looks for leads in column and file names. A file called "sick notes" is a lead. Whether it really holds health data is for a person to check.
So your case handler answers both questions, yes or no. The leads are shown in the same dialog. Without both answers, no report can be created.
File the breach in the data protection module
Once you confirm, the breach record appears in the data protection module. Its description holds the count, the categories and the limits of the analysis. You can enter when you became aware of it. The data protection module then works out risk, the duty to report and the deadlines.
A second click does not create a second report. If no number of people is known at all, the module refuses to file on its own. You then file in the data protection module, with a number you have established yourself.
Leaks in several parts as one incident
Some leaks are published in several parts. You group the parts into one incident. Then one report covers all parts. A part fits only if victim and gang are the same.
Review and notify the people affected
The list of people shows everyone in the leak. The module marks your own people. For each person, you record: confirmed, rejected or not a person, such as a shared mailbox.
Only confirmed people can be marked as notified. You pick the channel: email, letter, phone, public notice or other. You add the date and, optionally, the letter's reference. The module sends nothing. It records what you did.
Access requests under Art. 15
If someone asks whether they are affected, the module searches all datasets by email, phone number or name. A name only counts as a hit with a matching date of birth. The answer also names what could not be searched. So "nothing found" never turns into a hasty "not affected".
The case file for the supervisory authority
The case file bundles the case: approval, Art. 33 report, people affected and audit trail. Open points come first, such as a missing approval. "Fully documented" only appears when nothing is left open.
There is no separate workflow for reports under theNIS2 directive. Check with your legal and data protection advisers first whether you may obtain and store leaked data. The module records your decision; it does not replace it. The articleevaluating ransomware leaks under the GDPRshows how the data comes in. If your team needs help in an emergency, ourincident responseteam steps in.
FAQ on reporting a data breach
- How fast do I have to report a data breach?
- Under Art. 33 GDPR, within 72 hours of becoming aware of it. Leak-Ingest supplies the facts. The data protection module works out whether you must report and by when.
- Why is the number of people only a floor?
- Some rows have no identifier such as an email address, so they cannot be tied to a person. If the analysis is still running, more are missing. The module says so instead of faking a round number.
- Does the module detect health data automatically?
- No. It only finds leads in column and file names. Your case handler decides whether special categories under Art. 9 or criminal data under Art. 10 are involved. Without both answers, no report is created.
- Does Leak-Ingest send the notices to the people affected?
- No. You inform people through your usual channels, for example by letter or email. The module records whom you notified, when and through which channel. That puts the proof in the case file.
Your next report, backed by solid numbers
We walk you through one case, from the leak to the case file.
Request a demoHow we work with you
We want to work with you for the long run, not just deliver once. Our way of working has four steps. So you always know what comes next, who does what and what you get.
1. Free initial conversation
We learn where you stand and what you want. In 30 to 45 minutes we check if we are a good fit. We show you options and answer your questions. There is no obligation.
2. Current state review
We check where you stand today: tech, processes and rules. You get a list of strengths and gaps, sorted by urgency. Our offer is based on it.
3. Delivery with a dedicated lead
An experienced lead guides you through the project. You get clear goals, an open plan for time and cost, and a status every week. All results are written down and belong to you.
4. Running and reviewing
After the project we stay with you. We run systems for you, check them at set times and keep track of open tasks. When new threats or new rules come up, we get in touch.