Leak database

How it works

Leaked datasets are large, messy files. A leak database turns them into something you can query: records are cleaned, indexed and linked to the breach they came from. A lookup by email address or domain returns the matching records and, in a well-run archive, the name of the breach and the data types involved.

Not every leak database serves defenders. Some are offered to buyers, who search them for credentials to try against other services. The same underlying data therefore supports both exposure assessment and attack preparation. MITRE ATT&CK notes that credentials can reach adversaries through breach dumps and other accessible data sets, and that adversaries may also buy them from dark web markets.

How it shows up in executive exposure

For an executive, a leak database answers a narrow question: which of this person's addresses and phone numbers appear in leaked data, and what was exposed next to them? A hit with a password is more serious than a hit with only a name. A hit that appears across several unrelated breaches suggests the same address and password may have been reused.

WebThreat's CEM checks breach corpora and leak databases to show which records of each executive it finds from a company name are exposed, ranked by what to fix first. It works outside in and installs nothing. The methodology lists the factors. For how leaked data spreads before it lands in an archive, see the article on how stolen data is sold.

How to reduce the risk

• Reset passwords that appear in any leak and make each password unique.
• Use multi-factor authentication on email and financial accounts.
• Review old accounts and close the ones no longer needed.
• Treat a hit as a historic fact about the data, and confirm which accounts are still active.

How it differs from related terms

A breach corpus is the body of stolen records itself. A leak database is the searchable form of it, so the two overlap. A combolist is a raw list of credential pairs without breach context. A stealer log comes from malware on a victim's device rather than from a breached service.