Data Leaks
The Data Leaks view focuses on events where eCrime.ch has observed leaked data, file listings, publication evidence, or other indicators that an actor claim moved beyond a simple announcement.
What Counts as Data-Leak Evidence
Section titled “What Counts as Data-Leak Evidence”Evidence can include:
- published files or downloadable archives
- indexed file-list metadata
- screenshots of published data
- torrent metadata or active distribution
- leak-site updates that announce data publication
- analyst confirmation added during enrichment
Why This View Is Useful
Section titled “Why This View Is Useful”Use Data Leaks to prioritize cases that need faster review. A claim with observed leaked data may require a different response than an initial extortion post with no published files.
Common workflows include:
- reviewing newly leaked data events
- validating customer, supplier, or watchlist exposure
- pivoting into File Leak Search for file-name evidence
- checking whether an event has torrent activity
- separating claims from confirmed publication evidence
Relationship to the Tracker
Section titled “Relationship to the Tracker”The main tracker includes both claims and data-leak status. The Data Leaks intelligence view narrows attention to events where publication evidence is available or worth closer review.