Breach corpus
A breach corpus is a collection of records stolen in data breaches and gathered into one searchable body of data. It typically holds email addresses, usernames, passwords or password hashes and other fields, and it is used by researchers, defenders and attackers to look up whether an account was exposed.
Current as of · Editorial policy
How it works
When an attacker steals a database from a service, the records are often copied, traded and merged with other leaks. A breach corpus is the result of that gathering: many breaches in one place, usually keyed by email address so that a lookup returns every breach in which the address appears.
Public examples exist. Have I Been Pwned defines a breach as an incident where data is inadvertently exposed in a vulnerable system, and it aggregates breaches so that people can check where their personal data has been exposed. Large unofficial compilations circulate too, and many are combolists rather than corpora because they drop the breach each record came from. Collection #1 held 2,692,818,238 rows of email addresses and passwords from thousands of sources. Troy Hunt found it as a set of files on the cloud service MEGA, and the data was also being shared on a hacking forum.
How it shows up in executive exposure
A corpus lets you ask a precise question: in which breaches do this executive's addresses appear, and which fields were exposed? The answer is the raw material for an exposure assessment. Records are tied to the person, not to the company's own systems, so a corpus often shows exposure from personal accounts.
Defenders use corpora in authentication too. NIST SP 800-63B requires verifiers to compare new passwords against a blocklist of commonly used, expected or compromised passwords, and gives passwords obtained from previous breach corpuses as an example of what the list may include, so that known-compromised passwords cannot be chosen.
WebThreat's CEM checks each executive's addresses against breach corpora and leak databases and ranks what to fix first. See the methodology for the factors. EDG3 watches the dark web forums, marketplaces and Telegram channels where stolen data is posted and sold; the market itself is the subject of the article on how stolen data is sold.
How to reduce the risk
- Check whether your addresses appear in a corpus and treat every hit as a prompt to reset that password.
- Block known-compromised passwords at sign-up and password change, as NIST describes.
- Enable multi-factor authentication so a leaked password alone is not enough.
- Do not reuse passwords between services.
How it differs from related terms
A breach corpus is a body of data. A leak database is a searchable service or archive of leaked records, and the two terms overlap. A combolist is a stripped-down list of email and password pairs built for attacks, usually without the context of which breach each pair came from. A corpus usually keeps that provenance, which is what makes it useful for assessment.
Frequently asked questions
Why does NIST mention breach corpuses?
NIST SP 800-63B says new passwords must be checked against a blocklist, and gives passwords from previous breach corpuses as an example of what the list may hold. That stops people from choosing a password attackers already have.
Does a hit in a corpus mean the password still works?
Not necessarily. It means the password was exposed at some point. Treat it as compromised and change it wherever it was used.
Sources
- NIST SP 800-63B Digital Identity Guidelines: Authentication and Authenticator Management, NIST, accessed
- The 773 Million Record "Collection #1" Data Breach, Troy Hunt, accessed
- Have I Been Pwned FAQs, Have I Been Pwned, accessed
Related terms
See your leadership's exposure
CEM finds your executives from your company name, checks them against breach corpora and leak databases, and scores each person from 0 to 100.