Every few months a prospective client asks why we are slower than a competitor who found a subject's personal phone number in an afternoon. Often the honest answer is that the competitor searched stolen data. We will not, and we would rather explain that before the engagement than in front of a judge afterward.
The temptation
Large compilations of breached records are now indexed and searchable by email address, username, phone number or name. A single query can return addresses, dates of birth, IP addresses, account histories and passwords, sometimes hashed and sometimes not. A newer category, infostealer logs, contains credentials and browser data harvested from infected personal computers.
The appeal is obvious. These sources are fast. They connect usernames to email addresses and email addresses to people. And they work in exactly the places where lawful sources are thinnest: jurisdictions with strong privacy law, where people-search sites do not exist and personal details are not published.
Our position
We do not buy, download, search or rely on the contents of breached data or infostealer logs, and we never use credentials, however they were exposed. This is written into our standards and applies to every engagement and every analyst.
Two related activities are permitted because they do not involve the stolen contents:
- Breach notification checks. Services that report whether an address appeared in a named breach, without returning any of the breached data, tell a client about their own exposure.
- Observing leak claims. When a criminal claims to hold a client's data, we observe and preserve the public listing and its samples to test the claim, as described in Verify before you panic. We never buy the full set.
Reason one: lawfulness is not uniform
Possessing or processing stolen personal data is treated differently across the jurisdictions we work in. In many it engages data protection law, because breach records are personal data obtained without a lawful basis. In some it can engage criminal law. A practice that is tolerated in one country can be unlawful in the next, and our cases routinely cross borders.
A firm that works for courts, regulators and law enforcement cannot carry a method whose legality depends on where the subject happens to live.
Reason two: admissibility and taint
Our reports are written to be disclosed. In litigation, the other side is entitled to ask how each finding was reached, and our contemporaneous notes will answer. If the answer includes a breach compilation, the evidence derived from it is open to challenge.
The damage rarely stops at one item. In several legal systems, evidence obtained because of an unlawful step can be excluded along with the step itself. An attribution is a chain. If the link that connected a username to a real name came from stolen data, every finding built on that connection inherits the problem, however lawful the later steps were.
A finding is only as defensible as its weakest source. One tainted link can sink an entire attribution, and the client is the one who pays for it.
Reason three: reliability
Breach compilations are not records in any meaningful sense. They are merged, re-sold and re-labeled copies of other copies. Dates are missing or wrong, fields are misaligned, entries from different breaches are combined and some sets are padded with fabricated data to raise their price. Provenance is usually unknowable. In our grading scheme, a source whose origin cannot be established cannot be graded above "reliability cannot be judged", which means it could never carry an attribution on its own anyway.
Reason four: misuse
Searchable stolen data is a standing temptation. The analyst who uses it on a case today can use it on an ex-partner tomorrow, and no audit log fully prevents that. The most reliable control is not to hold the data or the access at all. Our analysts cannot search breach contents because we do not provide the means to do it.
What it costs us
This position has a price, and pretending otherwise would be dishonest. Some identifications take longer. Some never happen. In privacy-protective jurisdictions, the shortcut that turns an email address into a home address does not exist for us.
What we do instead is slower and, in our experience, more durable:
- Corporate registries, professional registers and court records, which often hold names, dates of birth by month and year, and service addresses.
- Newspaper archives and published notices, which link families, name changes and places over decades. See Newspapers do not forget.
- Account analysis that connects identities through what people publish openly. See A matching username is a lead, not a person.
- Infrastructure research, which identifies operators through registration history, certificates and shared identifiers.
In the 412 attributions with a known outcome that we track, the confirmation rate is 91 percent. None of them relied on stolen data.
When a client brings us a breach-derived lead
Clients sometimes arrive with a tip that came from breach data, found by an earlier provider or an internal team. We do not refuse to look at the question, but we treat the tip as untested and unusable as evidence. We record where it came from, set it aside and try to establish the same fact independently from lawful sources. If we can, the finding stands on its own. If we cannot, we say so, and the report does not repeat the tip.
Questions to ask any provider
- Do you search breached data, infostealer logs or credential dumps, directly or through a third-party tool?
- If a tool you use aggregates such data, how do you know which results came from it?
- Could you describe every source in your report to opposing counsel without hesitation?
- Who in your organization can search stolen data, and what stops them using it privately?