Introduction
Breach data analysis belongs in security operations, not in a side project. Run it well and you know which of your credentials are already exposed, how bad the exposure is, and what to rotate first, before someone else uses the password.
The rest of this is how to do that work without making a legal or ethical mess.
Understanding Breach Data
Types of Breach Data
- Credential dumps: Username and password pairs from compromised databases
- Combo lists: Aggregated credentials assembled from multiple breaches
- Stealer logs: Data harvested from infected devices by infostealer malware
- Database leaks: Full or partial database exports
- Paste site content: Credentials shared on public paste services
Stealer logs deserve separate handling from ordinary dumps because they carry session cookies and host context, not just credentials. Our overview of what stealer logs contain covers the difference.
Data Quality Considerations
Treat every record as untrusted until you score it. Before you act, weigh:
- Age: Older breaches often contain credentials that were rotated long ago
- Source verification: Some "breaches" are recycled compilations or outright fabrications
- Completeness: Partial dumps lack the context needed to attribute a record
- Format: Inconsistent formatting requires normalization before correlation
Setting Up Your Analysis Environment
Security Considerations
Handling breach data demands careful operational security:
- Isolated environment: Use dedicated VMs or air-gapped systems
- No authentication testing: Never test found credentials against live systems, including your own
- Data handling: Enforce encryption and access controls on the corpus
- Retention policies: Define retention limits and actually enforce them
Tools and Infrastructure
Core components for this work:
- Database systems: PostgreSQL or Elasticsearch for large datasets
- Query tools: Custom scripts, or a hosted lookup such as the Revealer.US data breach lookup when you do not want to hold the corpus yourself
- Visualization: Tooling for pattern analysis and reporting
- Secure storage: Encrypted storage with access logging
Holding raw breach corpora is a liability decision as much as a technical one. Many teams are better served querying an external index than storing terabytes of stolen credentials on their own infrastructure.
Analysis Methodologies
1. Domain-Based Analysis
Search for credentials tied to your organization's domains:
Queries:
- @company.com
- @subsidiary.com
- @acquired-company.com
What to look for:
- Active employee credentials
- Former employee accounts
- Service accounts
- Shared mailboxes
Acquired-company domains are the ones most often missed. They frequently keep working mail routing long after the acquisition closes.
2. User-Based Analysis
For targeted analysis of specific individuals:
- Personal email addresses, which often appear in work contexts
- Social media handles
- Phone numbers
- Usernames reused across platforms
Username reuse is the most productive thread here, since one handle often resolves to accounts across many services. A username search covers that pivot, and an email lookup does the same starting from an address.
3. Pattern Analysis
Look for the patterns that tend to show up again:
- Password reuse: The same password appearing across multiple breaches
- Weak passwords: Common or trivially guessable credentials
- Sequential exposure: Users showing up in several recent breaches
- Credential stuffing targets: Accounts at high-value services
4. Temporal Analysis
Breach timelines drive prioritization:
- When was the breach first observed?
- How recently were the credentials known to be active?
- Is the dataset actively being traded right now?
Prioritizing Findings
Critical Priority
- Active VPN or SSO credentials
- Admin or privileged accounts
- Service accounts with broad access
- Recently active credentials
High Priority
- Current employee accounts
- Credentials for sensitive systems
- Accounts where MFA can be bypassed with stolen cookies or tokens
Medium Priority
- Former employee accounts that may retain access
- Personal accounts belonging to employees
- Older credentials that may still be valid
Lower Priority
- Historical breaches where credentials have almost certainly rotated
- Accounts on non-sensitive systems
Response Actions
Immediate Actions
- Force a password reset for every confirmed exposure
- Revoke active sessions so stolen cookies stop working
- Review access logs for suspicious activity
- Enable or enforce MFA
Short-Term Actions
- Notify affected users with specific guidance, not a generic warning
- Audit for unauthorized access during the exposure window
- Review and tighten password policy
- Update awareness training to match the observed attack path
Long-Term Actions
- Implement continuous exposure monitoring
- Deploy credential screening inside authentication flows
- Improve detection for credential-based attacks
- Set a regular cadence for breach data review
Ethical and Legal Considerations
Authorized Use Only
- Analyze only data relevant to your own organization
- Follow the legal and regulatory requirements that apply to you
- Maintain documented data handling procedures
Responsible Disclosure
- Report discovered vulnerabilities through proper channels
- Never use found credentials to access an account, even to verify them
- Consider notifying affected third parties where appropriate
A Note on FCRA
Breach data cannot be used to make decisions about employment, tenancy or credit. Revealer.US is not a consumer reporting agency, and its results are not permitted for those purposes.
Where Revealer.US Fits
Revealer.US is an OSINT and people-search platform. One search by email, username, phone number, name or address checks 800+ platforms, public records and known breach datasets, which covers the identifier-resolution stage of the workflow above:
- Breadth: many sources checked in a single pass
- Fresh sources: newly surfaced data becomes searchable as sources update
- Structured output: results you can triage, not raw dumps to parse
- Identifier pivots: move between email, username and phone without rebuilding the query
Conclusion
Good breach data analysis is method, handling, and a hard line on what you will not do with the data. Miss any of the three and you either miss the exposure or create a new problem. Get them right and you find the leak while it still matters, instead of reading about it in the incident report.
Frequently asked questions
What is the difference between a breach dump and a stealer log? A breach dump comes from a compromised service and contains that service's user records. A stealer log comes from one infected device and contains everything the malware found on it: credentials for many services, cookies, autofill data and host details.
Is it legal to analyze breach data? Analyzing exposure relating to your own organization is standard defensive practice, but the rules vary by jurisdiction and data type. Never authenticate with found credentials, keep handling documented, and do not use the data for employment, tenant or credit decisions.
How do I know whether a breach dataset is real? Check whether the records fit the claimed source: plausible field structure, matching registration dates, and overlap with corroborated data. Recycled compilations repackaged as new breaches are common, so verify before you trigger a company-wide reset.
How often should we run breach data analysis? Continuous monitoring is the target, with a scheduled deeper review monthly or quarterly. Point-in-time checks miss the window that matters most, which is the first days after data surfaces.
Should we store breach data ourselves? Only with a clear reason and strong controls. A large local corpus of stolen credentials is a serious liability. Most teams get what they need from a hosted data breach lookup without holding the data.
What should we do about former employees' exposed credentials? Confirm the accounts are fully deprovisioned rather than just disabled, including SSO, VPN and any service accounts they owned. Lingering access on a departed employee's account is a common route into an environment.
Start with your own exposure. Try Revealer.US free, or compare plans from the free tier through self-serve at $12.99/mo.