Skip to content
SecTepeMit Sicherheit gut aufgestellt!
DE
Back to Leak-Ingest
My Leaks

Check a data breach: employees see their own hits

"Has my email been hacked?" Every IT team hears this question. With My Leaks, your staff answer it themselves. No ticket needed, and no view of anyone else's data.

Request a demo

What employees see on their page

My Leaks is its own page in SecTepe.Core. Every logged-in person opens it for themselves. It shows:

  • Your work address is checked automatically.
  • For each finding: the source, the date if known, and which kinds of data are affected.
  • A clear flag: "password affected" or "hash affected".
  • A summary: leaks found, how many with a password, addresses affected, active sources.
  • A notice when a source could not be reached.

So there is no false all-clear. If a source is missing, the page says so.

Where the hits come from

Depending on your setup, the page combines up to three sources:

  • Dark web findings fromthreat intelligence, plus a live lookup at an external service for known data breaches.
  • Findings from SnapScan, if your company uses it and has linked it.
  • Datasets from Leak-Ingest: only exact hits on the address count, and only from leaks that are fully analysed. Every such lookup goes into the audit log.

Private addresses with double opt-in

Some people also use private addresses for work accounts. So each person can add up to five private addresses. Double opt-in means: an address only counts once it is confirmed from its own inbox.

  1. You enter the address.
  2. You get an email with a link. It is valid for 24 hours.
  3. After the click, the address is checked. Before that, the system does not look it up in any source.

If the link has expired, you can ask for a new one after five minutes. You can remove an address yourself at any time. The confirmation code is only stored as a checksum, never in plain text.

Privacy: each person only sees themselves

  • Own addresses only: who is checked comes from the login, not from any input. Other people's addresses cannot be looked up.
  • Metadata only: the page shows source, date and kinds of data. A password or other secret never appears.
  • Discreet: if two colleagues check the same shared mailbox, neither learns about the other.
  • Traceable: adding and confirming an address is logged, with the address masked.

The actual analysis of a leak stays with the data protection officer. How they notify people is covered underreporting a data breach. The articleevaluating ransomware leaks under the GDPRexplains how the data comes in.

Does someone have a hit with a password? Then they should change it everywhere they use it. Otherwisecredential stuffingis a risk: attackers try leaked passwords on many services by machine.

FAQ on checking a data breach

Can I check whether a colleague's email is in a data breach?
No. My Leaks only checks the addresses of the person who is logged in. The work address comes from the login. Private addresses only count once they are confirmed from that person's own inbox.
Why do I have to confirm private addresses?
So that nobody can spy on other people's addresses. You get an email with a link that is valid for 24 hours. Only after you click it does the system check the address. Without confirmation, nothing happens.
Will I see my leaked password?
No. You only see that a password or hash is affected. The value itself is never shown. Change the password at the service in question, and everywhere else you use it.
Does "no hits" mean my data is safe?
Not necessarily. The page only knows the sources it is connected to. If a source could not be reached, it says so. "No hits" means: nothing found in these sources.

More topics

Fewer tickets, clearer answers for your staff

We show you My Leaks from the view of an employee and of an admin.

Request a demo

How we work with you

We want to work with you for the long run, not just deliver once. Our way of working has four steps. So you always know what comes next, who does what and what you get.

1. Free initial conversation

We learn where you stand and what you want. In 30 to 45 minutes we check if we are a good fit. We show you options and answer your questions. There is no obligation.

2. Current state review

We check where you stand today: tech, processes and rules. You get a list of strengths and gaps, sorted by urgency. Our offer is based on it.

3. Delivery with a dedicated lead

An experienced lead guides you through the project. You get clear goals, an open plan for time and cost, and a status every week. All results are written down and belong to you.

4. Running and reviewing

After the project we stay with you. We run systems for you, check them at set times and keep track of open tasks. When new threats or new rules come up, we get in touch.