What to do if your company's data appears on a leak site or the dark web
An alert, a journalist or a client says your data is on a leak site. Before you announce anything, establish whether it's really yours, whether it's new, and where it came from.
Reviewed by the ITRS security team · Last updated
Is it really your data?
Leak-site claims are not always true. Criminal groups exaggerate, recycle old dumps under new names, or list a company to pressure it. 'Combo lists' of email addresses and passwords that include your domain are common and usually come from employees reusing work email on other websites that were breached.
Get a description or sample through a safe channel (your responder, a threat-intelligence provider, or law enforcement) and compare it to what you actually hold: file names, folder structure, internal document numbers, dates, and fields in any database extract.
Old breach, third-party breach or new incident?
| What you find | Likely source | What it means |
|---|---|---|
Old files; nothing newer than a past known incident | Previously known breach | Check that past notifications and records covered this data |
Data that only a supplier or service provider held | Third-party breach | Engage the vendor; you may still have obligations as the controller |
Recent internal files from your servers or cloud | New incident on your systems | Start incident response now |
Only emails and passwords from many unrelated sites | Credential reuse on other sites | Force password resets; check sign-ins; enforce MFA |
Capture evidence safely
- Record the URL or onion address, the group's name, the listing date, any countdown or deadline, and the sample file names, using screenshots taken by your responder.
- Have collected samples hashed and stored securely with chain-of-custody notes.
- Preserve your own logs from the likely exposure window (firewall, VPN, cloud audit logs, file server access) before they age out.
- Don't contact the group. If counsel decides contact is needed, it should be planned.
Credential resets and monitoring
If credentials are involved, reset the passwords of affected accounts, revoke their sessions, and check sign-in logs for use of those credentials. Look for successful sign-ins without MFA, legacy authentication, and new inbox rules. Move to phishing-resistant MFA where you can.
Increase monitoring for several weeks. Published data fuels follow-on phishing and impersonation of your organization; warn staff and finance, and see What to do if clients receive fake invoices that look like they're from you if invoice fraud follows.
Notification obligations
If personal information under your control is involved, the posting may itself show that a breach of security safeguards has happened, and public availability raises the probability of misuse, one of the two key factors in the real-risk-of-significant-harm test used by the Office of the Privacy Commissioner of Canada. If the test is met, report to the OPC and notify affected individuals as soon as feasible; keep a record of the breach for 24 months in any case. Provincial and sector rules may also apply.
Reporting to the Canadian Centre for Cyber Security (cyber.gc.ca/en/incident-management) and to police through reportcyberandfraud.canada.ca is also open to you.
Talk to counsel
Bring your lawyer in before you make public statements, contact affected clients, or respond to media. Counsel can manage privilege over the investigation, coordinate with your insurer, and decide on notification wording and timing. Call our 24/7 line at (289) 582-9930 to start verification and evidence capture.
Common questions
Payment doesn't guarantee deletion, and the data is often already copied. Any decision about engaging with a criminal group involves legal, insurance and sanctions questions and should be made with counsel and your insurer.
Sometimes, through hosting providers or law enforcement, but rarely quickly and never with certainty. Plan your response on the basis that the data is out.
Related reading.
- PageUnder attack? Start hereIf something is wrong right now, this page tells you what to do in the next few minutes, what to avoid, and which step-by-step guide fits what you are seeing.
- GuideWhat to do if you receive an extortion emailMost extortion emails are bluffs sent to thousands of people. Some are not. Here is how to tell the difference without engaging the sender, and what to do in each case.
- ArticleReal risk of significant harm: how the assessment worksWhether a Canadian privacy breach must be reported usually turns on one judgment: does it create a real risk of significant harm? The legal test is short.
- ServiceDigital forensics in Toronto: computers, phones, Microsoft 365 and Google WorkspaceIT Rapid Support provides digital and computer forensics services for businesses in Toronto, the GTA and Ontario, focused on Microsoft 365, Exchange Online and Google…
Under attack right now?
Call before you reset passwords, wipe a laptop or pay anyone. A responder will help you contain the incident without destroying the evidence you will need later.