What breach intelligence is

Leaked data doesn’t originate at the company it concerns. It originates from a breach of a third party: a service where someone had an account under a company email gets compromised, and its user database ends up out in the open. If the password was the same as the one for the company, company access is suddenly public without anything having failed at the company itself.

Breach intelligence collects these leaks from four kinds of source: public breach corpora that aggregate large past leaks, leak databases circulating around the internet, dark web forums where access is resold, and credential stuffing lists, meaning bulk lists of email and password pairs. What they have in common is that all of it has already leaked.

It serves one purpose: to find out which of your credentials are already publicly available before someone abuses them. A leaked password is a quiet way in, because a login with a valid account raises no alarm. Anyone who knows a specific account is out there can invalidate the password, enforce multi-factor authentication, and revoke sessions before an attacker reaches the account.

In practice it is a defense against account takeover and against the attacks that follow. Leaked company passwords are raw material for targeted phishing and for fraudulent payments, so how leaked passwords get abused is the other side of the same coin. The continuous form of this defense is data breach monitoring as a service.

It isn’t hacking. Breach intelligence breaks nothing and bypasses nothing. It works exclusively with data that has already leaked and lies in public or on the dark web. Dark web monitoring here means only reading the more closed-off places an ordinary search engine can’t reach, not an active intervention.

It isn’t OSINT, or open-source intelligence, either, and it isn’t a penetration test. OSINT is reconnaissance from public sources before an attack, which assembles a picture of the target from open information; breach intelligence looks more narrowly, specifically at credentials that have already leaked. A penetration test, in turn, actively looks for vulnerabilities in live systems, whereas breach intelligence touches no system at all.

Leaked data includes personal data such as emails and passwords, so processing it falls under GDPR, even though it is data that has already leaked into public or onto the dark web. The fact that it is available doesn’t in itself mean it may be handled in any way you like.

This entry doesn’t judge what is legal in your case, and it isn’t legal advice. Assessing a specific processing operation belongs to your data protection officer or your lawyer. The factual position is only this: breach intelligence works with data that has already leaked, not with data obtained by breaking in.