GDE-081 |
Data breach verification | |||||||
Digital infrastructure | ||||||||
October 2026 | ||||||||
01
What it is
A data breach is an incident in which personal or confidential data is accessed, copied or disclosed without authorisation. Verifying one means confirming who was hit, when it happened and what data was exposed, using company statements, regulatory filings, breach registers and leak-site trackers.
Breach news usually starts with one claim: a ransomware group posts a victim name, a customer receives a warning email or a reporter cites an unnamed source. Each of those is a lead, not a finding. Verification tests the claim against records the organisation, a regulator or an independent tracker has published.
A ransomware leak site is a page where an extortion group names the organisations it says it has hit and threatens to publish their data. Journalists use this workflow before reporting a breach, researchers use it to date an incident and anyone told their data was stolen can use it to see what the organisation has confirmed.
| When to use this guide
|
02
How do you verify a data breach?
Seven free sources and seven steps take you from a single claim to a graded, documented finding.
Every source below is free, and none needs an account for the checks in this guide.
Have I Been Pwned: Free, no login for single email and breach list searches. Each breach page shows the breach date, the date it was added and the data classes exposed, and HIBP labels breaches it treats as unverified or fabricated.
Ransomware.live: Free, no login. Monitors ransomware group leak sites and lists newly posted victims with the date and group, so you can read an attacker claim without visiting the leak site.
SEC EDGAR full text search: Free, no login. Searches the text of US company filings since 2001, including the Form 8-K reports where listed companies disclose cybersecurity incidents.
FCA National Storage Mechanism: Free, no login. The official store of regulatory announcements from UK listed companies, searchable by company and date.
California Attorney General data breach list: Free, no login. Lists breach notices sent to more than 500 California residents, each with a copy of the sample notification letter.
HHS Office for Civil Rights breach portal: Free, no login. Lists US health data breaches affecting 500 or more individuals.
Wayback Machine: Free. Save Page Now captures a statement or victim listing with a timestamp; some capture options need a free account.
| Before you begin Stop at the login. Every source here works without an account. Do not register on a forum, contact a ransomware group or open a leak site to see the data for yourself; the trackers and filings in this guide are enough to grade a claim. Legal considerations. Do not download, open or buy leaked files. Stolen records usually contain personal data, which brings obligations under GDPR and UK GDPR, and handling stolen material can carry further legal risk in some jurisdictions; take legal advice before you handle any sample. |
Record the organisation named, the date, what data is said to be involved and who made the claim: the company, a regulator, an attacker, a customer or a reporter. Note the original source rather than the article that repeated it.
Check the company’s newsroom, investor relations page, status page and customer emails. Save each page in the Wayback Machine as soon as you find it, because breach statements are often edited as an investigation develops.
In SEC EDGAR full text search, search the company name with terms such as cybersecurity incident and filter to Form 8-K. Item 1.05 is generally due four business days after a company decides an incident is material; other incidents may appear under Item 8.01. For UK listed companies, search the FCA National Storage Mechanism.
Search the California Attorney General list and, for health data, the HHS breach portal. These entries often give the breach dates, the data types and a copy of the letter sent to individuals. UK breaches are reported to the ICO, where feasible within 72 hours, so a UK case leans more on the company statement and stock exchange announcements.
Search the organisation name and record the group, the posting date and any note that the victim has denied the claim. A leak-site listing shows that a group says it holds data; on its own it does not show what was taken.
Search the breach list for the organisation. A listing gives the breach date, the date added and the data classes, and its label tells you whether HIBP treats it as verified, unverified or fabricated.
Use the four LST-001 confidence tiers. A company statement or regulatory filing makes a breach Confirmed; a register notice or HIBP analysis with matching dates makes it Corroborated; a credible report without those is Reported; an attacker post alone is Alleged.
|
03
Where data breach checks go wrong
Most errors come from treating a claim as a confirmation, or old data as a new incident.
Leak-site post read as a confirmed data breach: Extortion groups post victims to apply pressure, and some listings are exaggerated, recycled from another group or withdrawn. The post shows a claim, not a breach. Verifying check: the organisation, a regulator filing or a register notice confirms an incident in the same period.
Old or recycled data read as a new breach: Compilations of earlier breaches are often relabelled and sold as fresh dumps of a well-known brand. The records can be real while the new breach is not. Verifying check: the breach date in the company notice or HIBP listing falls in the period being claimed.
Supplier breach attributed to the brand: Many notices concern a payroll, marketing or software supplier that held a company’s data, not the company’s own systems. Verifying check: the notice names the organisation whose systems were accessed, and your wording names the same one.
Cyber attack read as a data breach: Ransomware can shut down tills, websites or warehouses without any data being taken. A disruption is not automatically a breach. Verifying check: a statement or filing says data was accessed or taken, and names its types.
Chain of custody: Your evidence is the set of public records you checked, captured as they stood on the day. Keep them so an editor, lawyer or court can retrace each step and reach the same grade.
Archive the company statement in the Wayback Machine and keep a dated screenshot
Save each filing, register entry and tracker listing with its URL and retrieval time
Record the confidence tier you assigned and the evidence that supports it
Log every later change to the company statement, with old and new wording
Keep no leaked files; note only what published records list as exposed
04
Go deeper
Two reference cards for safe dark web access and preserving online evidence.
CARD · DRK-001
Dark web access for OSINT investigators
Tor Browser, Tails and Whonix, set up for isolated sessions that hold up to chain-of-custody review.
CARD · SOC-002 · SIGNAL TIER
Social media evidence preservation for investigators
Hunchly and the Wayback Machine, used to capture and hash content before it is taken down.
Evidentiary standard
Signal & Shadow operates to the LST-001 evidentiary standard. All claims are graded against the LST-001 v1.0.3 confidence tiers (Confirmed, Corroborated, Reported, Alleged) per the canonical voice and structural specification.
About Signal & Shadow
Signal & Shadow is an independent forensic investigation and methodology practice publishing tutorials, reference cards, and forensic dossiers for working practitioners. Founded by Derek Bowler.