Find leaked passwords and change them where it counts
A leaked password is an open door. It stays open from the day the leak appears. Leak-Ingest turns the accesses it finds into a worklist for your IT team.
Request a demoWhy leaked credentials cannot wait
You have 72 hours to report under Art. 33 GDPR. A published password, on the other hand, works right away. Attackers try such data on many services at once, by machine. This is calledcredential stuffing.
So next to "Who is affected?", Leak-Ingest asks a second question: What can still be opened? The answer is for the people who run your systems.
What the module finds in a leak
- Passwords in plain text, readable as they are
- Password hashes, a scrambled form of the password
- API keys and private keys
- Connection strings, for example the login to a database
- Whole credential stores such as password databases, keys or VPN profiles
Your own accounts first
The module checks your user list and your domains to see which accounts and systems are yours. This helps most with a supplier's leak. There, a few of your accounts can hide among thousands of others. Plain text is counted apart from hashes and marked red. One readable admin password weighs more than a hundred hashes.
The secret stays hidden
The module never shows a password or a key. The value does not come out through the API either. You see the account, the system, where it was found and its form: plain text, hash, key or token. That is all your IT team needs to change the access.
The worklist: one status per access
- Open: Nobody has looked at this access yet.
- Tested: still opens: The access still works. It sits at the top, marked red, and still counts as open.
- Tested: no longer opens: The test failed. The entry counts as done.
- Rotated: Your IT team has changed the password or key.
- Invalid: The finding is not a real access.
Done entries move to the bottom. Setting a status takes one click. You can also undo it if someone picked the wrong row. You can add a note. Every status goes into the audit log, with account and system, never with the secret.
Note: a changed password is still in the leaked file. The list records your response, not a change to the leak.
Partial download: files that may hold credentials first
A whole leak can take days to download. Your IT team does not have to wait that long. From the file list of the leak site, the module can fetch only the files that may hold credentials. The module picks the files. You can cap how many.
This download also needs an approval for the domain. The partial dataset is marked as incomplete, so nobody takes it for the whole leak. If the assessment finds plain-text passwords, a link leads straight to the worklist.
The report to the authority runs in parallel, seereporting a data breach. If things get tight, ourincident responseteam helps. The articleevaluating ransomware leaks under the GDPRexplains how the data comes in. Check the legal side before you download leaked data. The module records your decision; it does not replace it.
FAQ on leaked credentials
- Can I see the leaked password in plain text?
- No. The module never shows a secret and never returns one through its API. You see the account, the system, where it was found and whether the password is readable or hashed. That is enough to change it.
- Do I have to download the whole leak first?
- No. You can start by fetching only the files that may hold credentials. This also needs an approval for the domain. The partial dataset is marked as incomplete.
- What does "Tested: still opens" mean?
- Someone tested the access, and it still works. That is not progress; it is a confirmed open door. So the entry stays at the top and counts as open work until it is rotated.
- Does the module find every password in the leak?
- Not guaranteed. It detects columns that hold secrets, typical plain-text patterns and files such as password databases. It does not read the content of every single file. The module says so openly.
Close open doors before someone walks through
We show you the worklist on an example and clarify what you need for it.
Request a demoHow we work with you
We want to work with you for the long run, not just deliver once. Our way of working has four steps. So you always know what comes next, who does what and what you get.
1. Free initial conversation
We learn where you stand and what you want. In 30 to 45 minutes we check if we are a good fit. We show you options and answer your questions. There is no obligation.
2. Current state review
We check where you stand today: tech, processes and rules. You get a list of strengths and gaps, sorted by urgency. Our offer is based on it.
3. Delivery with a dedicated lead
An experienced lead guides you through the project. You get clear goals, an open plan for time and cost, and a status every week. All results are written down and belong to you.
4. Running and reviewing
After the project we stay with you. We run systems for you, check them at set times and keep track of open tasks. When new threats or new rules come up, we get in touch.