Data Leak Detection — Search Across Breached Data // MODULES

Data Leak Detection — Search Across Breached Data

A search engine over the archive of leaked documents the platform indexes — dumps, combolists, infostealer logs, forum drops and material uploaded by the customer itself. Queries are federated: one request goes out to every configured index server, and the responses come back merged into a single result set.

Overview

Every document enters the index sliced into passages. A search matches the term against the passage text (weight 3), the file name (weight 2) and the section and title metadata, tolerates typos, and returns up to three fragments with the term highlighted mid-sentence — the analyst reads the context without opening the file.

Three aggregations sit on top of the results and serve both as filters and as a diagnosis of the finding: by file type, by category and by originating source. That is how you discover, for example, that the same CNPJ (Brazil’s corporate taxpayer ID) appears in fifteen spreadsheets from one source and in a single e-mail from another.

How It Works Underneath

Federation and pagination. The platform discovers its index servers from the environment configuration and queries all of them. Aggregations are summed key by key, results are re-ranked by relevance across the already-merged set, and only then paginated. If one server fails, the others still answer and the failure is recorded — the search is not held hostage by the slowest node.

Fail-closed isolation. The organization filter is always applied for anyone who is not a global administrator, even where the organization field does not yet exist on part of the indexed corpus. The effect is deliberate: a document without the field does not match and does not surface. The engineering decision was to replace the old behavior — which dropped the filter when the field was missing and returned everything — with one that errs on the side of returning too little. In breached-data search, a false negative is an inconvenience; a cross-tenant leak is an incident.

Cross-source fingerprinting. The same file circulates through several channels. The platform stores sha256, sha1 and md5 for every document, along with an occurrence counter and first- and last-seen dates. That answers a question full-text search cannot: is this dump new, or is it March’s dump repackaged?

Attribution with declared confidence. Each fingerprint can carry attributions — actor, campaign, source channel (Telegram, forum, paste site, marketplace, stealer log, dark web, clear web, partner feed, manual upload), the URL and handle of whoever posted it, plus the supporting rationale. Confidence has three levels and the criterion for each one is explicit: low is automated heuristics, medium is cross-source correlation, high requires human review with multiple signals. The reviewer’s name and date stay on the record.

Capabilities

  • Structured selectors: e-mail, domain, URL, IPv4, IPv6, phone number, Bitcoin address, Ethereum address, CPF and CNPJ (Brazil’s individual and corporate taxpayer IDs)
  • Text extraction from PDF, DOCX, XLSX, PPTX, HTML and EML, and from ZIP, RAR and 7z archives
  • Saved searches with optional sharing inside the organization; editable by their author or by the organization administrator
  • Export to JSON or CSV, capped at 100, 500, 1,000 or 5,000 results
  • Auditing of six events — search, view, download, export, save and delete a search — with IP, query, filters, result count and response time

Use Cases

  • Check whether corporate credentials showed up in a recent drop, and through which channel
  • Trace the exposure of customer CPF or CNPJ numbers in databases being traded
  • Determine whether a dump advertised as brand new was already circulating, using the occurrence counter
  • Assemble the provenance evidence behind a breach notification or a takedown request

What the Module Does Not Do

  • A saved search does not raise an alert. It stores the query for reuse; it does not schedule it. Continuous watch with notification is the job of Threat Monitoring, which queries this same archive.
  • It does not call HaveIBeenPwned, DeHashed or equivalent third-party services.
  • It does not write to your corporate directory: it neither forces a password reset nor disables an account in Active Directory or Entra ID.
  • It does not assign attribution automatically at high confidence — the high band requires a human signature.
  • It does not store extracted text in the relational database; that text lives in the search index.

Integrations

  • Multi-server OpenSearch (ooda_leaks_* indices)
  • Airflow, for documents that need OCR before entering the index
  • OODA Threat Monitoring (recurring search over this archive) and OODA EASM (correlating leaks with perimeter assets)

SLA & Guarantees

Federated index with merged aggregations · fail-closed isolation per organization · every query audited

Next Steps