These more sensitive data sets are typically executed by more sophisticated actors and are often hacked government sites or protected data servers however, they are generally just as accessible as routine business breaches. Other data breaches can include personally identifiable information (PII) such as real name, phone number, email address, credit card, national identity documents (driver’s license, passport, national ID), and other protected information. Most of the company breaches are simply usernames/email addresses and passwords, likely obtained from unsophisticated hacking crews scanning the Internet for unprotected servers left open for external connections. Almost every major US or multinational company has been or will be, hacked. While the act of the breach itself is illegal, obtaining and using the data after it has been leaked is both lawful and very useful in OSINT investigations. “Breach Data” is data that is made publicly available by individuals or entities that perpetrate data breaches. To do so, it is worth taking a step back to understand what exactly data breach is and what we can do with it. There may be a silver lining to breach data for those of us who conduct open source intelligence (OSINT) investigations that is not frequently discussed. Cyber security systems may be growing more sophisticated, but so too are attacks designed to collect personal data.

In 2018 there were reportedly 1,244 data breaches totaling over 446 million exposed records, primarily targeting the business sector and health care fields.

Download free in to the breach