Account takeover is an attacker's control of an existing account through valid credentials or a valid session that belong to someone else. It is an outcome, reached through stolen passwords, credential stuffing, stolen session cookies or social engineering.
A breach corpus is a collection of records stolen in data breaches and gathered into one searchable body of data. It typically holds email addresses, usernames, passwords or password hashes and other fields, and it is used by researchers, defenders and attackers to look up whether an account was exposed.
Business email compromise is a scam aimed at businesses and individuals that regularly make wire transfers. Fraudsters compromise or imitate email accounts and other communications, using social engineering or intrusion, to trigger an unauthorized transfer of funds. The FBI tracks it as a separate crime type.
CEO fraud is a form of business email compromise in which a fraudster poses as a company's CEO or another senior executive and pressures an employee with payment authority to make an urgent, unauthorized transfer. The request usually stresses urgency and asks the employee to keep it confidential.
A combolist is a text file of email and password pairs, one per line, assembled from many sources and used for automated login attacks. It strips out where each pair came from, so the same data is recycled, repackaged and resold under new names.
A credential pair is a username, usually an email address, together with the password that goes with it. In breach and leak data, pairs are the unit attackers replay against other sites. A pair becomes dangerous when the same password protects more than one account.
Credential stuffing is the automated replay of stolen username and password pairs against login pages of other services. It succeeds where people reuse passwords. The pairs come from breaches and lists, not from guessing, so a single leak can open accounts far from the original breach.
DORA, the Digital Operational Resilience Act, is Regulation (EU) 2022/2554 on the ICT resilience of financial entities. It has applied since 17 January 2025 to banks, insurers and other financial entities. Article 5 makes the management body define, approve, oversee and be responsible for the ICT risk management framework.
The dark web is the part of the internet reachable only through anonymizing software such as Tor, usually via .onion addresses. It hosts legitimate services as well as criminal ones. Stolen data is traded there and in Telegram and other channels, and WebThreat's EDG3 watches both.
Doxxing is gathering a person's personal information, such as home address, phone number and family details, from open sources or compromised material, and publishing it online to harm, harass or intimidate them. CISA notes that senior leaders can be targeted for their position or their stance on an issue.
The executive attack surface is the set of points where an attacker can reach a company through its leaders: their accounts, devices, contact details, public profiles, family information and the data about them in breaches. WebThreat measures its breach-data layer with CEM and its listing layer with Information Removal.
Executive digital exposure is the publicly available information that can be used to identify, profile or target a senior leader: public records, property records, social media and breach data. Its breach and leak part, the records tied to that leader in breach corpora and leak databases, can be measured from the outside.
GDPR Article 33 is the rule on notifying a personal data breach to the supervisory authority. The controller must notify without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to people's rights and freedoms.
A hashed password is the output of a one-way function applied to a password, stored instead of the password itself. A service compares hashes at login. If a database leaks, attackers hold hashes rather than passwords, and must crack them. Weak hashing makes that cracking fast.
An infostealer is malware built to collect data from an infected device, mainly saved passwords, browser cookies and autofill data, and send it to an attacker. The harvested data is packaged into stealer logs, which are then sold or shared with other criminals.
An initial access broker is a criminal who breaks into organizations and sells that access to other attackers, such as ransomware groups, instead of carrying out the final attack. Access is sold as credentials, remote desktop or VPN entry, or web shells.
A leak database is a searchable archive of records exposed in data breaches or leaks. It lets a user look up an email address, domain or username and see which leaked datasets contain it. Some are run by researchers for defense; others circulate among criminals.
NIS2 is the European Union's Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union. Article 20 requires Member States to make the management bodies of essential and important entities approve cybersecurity risk-management measures, oversee them and follow training.
Outside-in monitoring looks at an organization from the position of an outsider, using external data sources, without installing software, agents or connectors inside the company. It sees what an attacker could find from outside, not what happens on the internal network or on a device.
Password reuse is using the same password for more than one account. It turns one breach into many: a password stolen from a minor service can unlock email, banking or work accounts. It is the behavior that makes credential stuffing work.
Personally identifiable information is any information that can distinguish or trace a specific person, alone or combined with other data linked to them. Names, Social Security numbers and biometric records are standard examples. Context matters: details that look harmless can identify someone once combined.
A plaintext password is a password stored or exposed in readable form, with no hashing or encryption between the file and the person reading it. In breach data it is the most dangerous password format, because an attacker can try it immediately without any cracking step.
Pretexting is obtaining information or access under false pretenses, usually by posing as someone with a legitimate reason to ask. The attacker builds a believable story and a role, such as a colleague, supplier or account holder, to make the target comply.
A SIM swap is fraud in which a criminal persuades a mobile carrier to move a victim's phone service to a device the criminal controls. The criminal then receives the victim's calls and text messages, including one-time codes used to reset passwords or approve logins.
Session cookie theft is the stealing of the token a website sets after you log in. An attacker who holds a valid session cookie can use the account without the password and, depending on the service, without passing multi-factor authentication again, until the session expires or is revoked.
A stealer log is the package of data an infostealer collects from one infected device: the logins it captured, each with the site it belongs to, and often browser cookies as well. Logs are sold or shared in criminal channels and marketplaces, including on Telegram.
Swatting is the criminal act of giving law enforcement false information about a serious threat at a location, so that armed tactical units respond. It is used to harass or intimidate, and CISA lists company executives among its targets.
A threat actor is an individual or group that poses a threat to an organization or person. The label covers criminals, state-backed teams, hacktivists and insiders. It names who is behind an attack, as opposed to the malware or technique they use.
A ULP list is a file of stolen credentials in URL, login, password format: each line names the website, the account and the password. It is a combolist with the target site added, which tells an attacker exactly where each credential should be tried.
Whaling is spear phishing aimed at a senior target, such as a board member or executive with access to valuable assets. The message is tailored to one person and usually draws on researched detail about their role, contacts and current business.