Searching for exposed data

Choose a useful starting point

Begin with the identifier most closely connected to your question. A company domain can help you investigate organizational exposure. An email address can help you examine a specific account. A distinctive brand name can help you review mentions that deserve closer attention.

Use a small set of known identifiers first. Keep a record of the terms you checked so another analyst can understand the scope of the review.

Check the connection

Review each match in its original context where that context is available. Confirm the spelling of the domain or account and look for details connecting the record to your organization.

Shared names, former employees, personal accounts, and third-party services can complicate a match. An address ending in your company domain establishes an association with that address; it does not by itself explain how the data was obtained or which system was affected.

Expand using verified details

Use relevant findings to identify the next search. A confirmed account, subsidiary name, or related domain may help you uncover additional records. Keep each expansion tied to the investigation question and your approved scope.

When several records appear to describe the same exposure, compare their contents and source references. Reposts can add context, but repeated copies do not necessarily represent separate incidents or independent confirmation.

Interpret gaps carefully

A search with no relevant results means no matching evidence was found within that search and the available coverage. It cannot establish that an organization has never experienced exposure.

If results are sparse, review your identifiers, check known naming variations, and revisit the question you are trying to answer. Avoid broadening the scope so far that the connection to your organization becomes unclear.

Record the result

Document the search terms, review date, relevant records, and any unresolved questions. Note whether the evidence requires immediate action, further investigation, or a later review. Continue with the findings guide to assess the records you have identified.