LeakTrace Intelligence · Updated Continuously

Breach Intelligence Feed

A curated database of documented breach events, credential threat actors, and attack techniques targeting individuals and organisations across North America.

340+
Breach events documented
17B+
Credential records indexed
24
Attack techniques catalogued
12
Threat actor categories
Featured Breach Events

Documented Incidents.

A curated record of significant breach events — credential exposures, ransomware campaigns, and identity theft operations that defined the current threat landscape.

Aug 2024
Critical
National Public Data

A data broker aggregating public records was breached, exposing 2.9 billion records including Social Security Numbers, names, addresses, and family relationships for nearly every adult in the US and Canada. The data appeared on criminal forums before the company acknowledged the breach.

Data Broker Identity Theft SSN Exposure
2.9B
records exposed
Jan 2025
Critical
Change Healthcare Ransomware

A ransomware attack on UnitedHealth's payment processing subsidiary disrupted healthcare operations across North America for months. Protected health information for an estimated 190 million patients was exfiltrated. The company paid a $22M ransom that did not prevent data publication.

Ransomware Healthcare PHI Exposure
190M
patients affected
Jul 2024
Critical
AT&T Call Record Exposure

Complete call and text records for 109 million AT&T customers were exfiltrated from a third-party cloud environment. The data included records of every number contacted by every customer over a 6-month period — enabling social graph mapping and targeted fraud at scale.

Telecom Metadata Exposure Social Graph
109M
customers affected
Jun 2024
High
Snowflake / Ticketmaster Campaign

A credential-stuffing campaign targeting cloud data warehouses compromised accounts at over 165 organisations including Ticketmaster, Santander Bank, and LendingTree. Attackers used previously stolen credentials to access unprotected Snowflake environments with no MFA enforced.

Credential Stuffing Cloud Storage No MFA
165+
organisations hit
Feb 2025
High
PowerSchool Student Data Breach

An education technology provider serving over 18,000 schools was breached via compromised credentials. Attackers accessed a support portal and exfiltrated student and teacher records including names, addresses, Social Security Numbers, and medical information for 62 million individuals.

Education Minor Records Credential Theft
62M
records exposed
Threat Actor Categories

Who Is Behind It.

The organisations and operator types responsible for credential theft, identity fraud, and business compromise targeting North American individuals and organisations.

Financially Motivated
Ransomware-as-a-Service Groups

Organised criminal networks operating ransomware infrastructure for hire. Affiliates gain initial access using stolen credentials from breach databases. Healthcare, legal, and financial services are primary targets due to high data sensitivity and payment willingness.

Ransomware Data Extortion Credential Reuse
Financially Motivated
BEC Operator Networks

Business email compromise operators who use publicly available information — executive names, domain structure, employee listings — to construct convincing impersonation attacks. No malware required. Real estate, legal, and financial services lose billions annually to these attacks.

BEC Wire Fraud Impersonation
Financially Motivated
Credential Harvesting Operations

Automated operations that aggregate credentials from breach databases, test them against financial and email platforms using stuffing tools, and sell validated access in bulk. These groups supply the initial access used by ransomware affiliates, BEC operators, and account takeover fraud networks.

Credential Stuffing ATO Fraud Access Brokering
Commercial
Data Broker Networks

Legally operating businesses that aggregate public records and sell detailed personal profiles — addresses, employment history, family connections, financial indicators — to anyone willing to pay. These profiles are directly used by criminals to build targeting packages before an attack.

Commercial Profile Aggregation PII Commerce
State-Sponsored
State-Sponsored Espionage Actors

Nation-state operators who target North American infrastructure, government contractors, and professional services firms for intelligence gathering. The Salt Typhoon telecom campaign and Volt Typhoon infrastructure pre-positioning are recent examples targeting Canadian and US networks.

APT Espionage Long-Dwell
Opportunistic
Automated Scanning Infrastructure

Continuous automated scanning operations that probe every internet-connected domain for exposed services, default credentials, and known vulnerabilities. These are not targeted attacks — they are industrialised reconnaissance that feeds findings to human operators or sells access to the highest bidder.

Automated Mass Scanning Access Brokering
Attack Techniques

How Attacks Begin.

An overview of the primary techniques used in credential theft, identity fraud, and business compromise attacks targeting North American individuals and organisations.

Credential Stuffing Initial Access
Automated testing of username and password pairs from breach databases against login portals. Because most people reuse passwords across accounts, a credential leaked in one breach provides access to dozens of unrelated services. Attackers run stuffing operations at scale — millions of attempts per hour — against banking, email, and corporate systems.
High Volume Password Reuse Automated
AI-Assisted Spear Phishing Social Engineering
Targeted phishing attacks personalised using publicly available information — LinkedIn profiles, company websites, breach data. AI tools now generate grammatically perfect, contextually accurate impersonation emails in seconds. 94% of recipients cannot distinguish AI-generated phishing from legitimate communication. Traditional spam filters are ineffective against highly personalised content.
AI-Enhanced Impersonation OSINT-Driven
Business Email Compromise Fraud
Attackers impersonate executives or trusted vendors to redirect wire transfers, obtain sensitive information, or gain access to corporate systems. No malware is required — only publicly available information about organisational structure, executive identities, and financial processes. BEC caused $2.9B in documented losses in 2023 alone. Real estate, legal, and financial services are the highest-risk verticals.
Wire Fraud Domain Spoofing No Malware Required
Attack Surface Scanning Reconnaissance
Automated tools continuously scan the entire internet for exposed services, open ports, misconfigured applications, and known vulnerabilities. Every business with a domain is scanned continuously — not because it is targeted, but because scanning is industrialised and indiscriminate. Findings are catalogued and sold as initial access or used directly by ransomware affiliates.
Automated Continuous Infrastructure Intel
Data Broker Profile Aggregation Pre-Attack Intel
Before executing any attack, adversaries build detailed target profiles using data broker services that legally aggregate public records. These profiles include home addresses, family members, employers, financial indicators, and historical records — available for cents per query. The resulting profile enables highly personalised attacks, SIM-swapping, and targeted social engineering that bypasses standard security controls.
Legal Sources PII Aggregation Pre-Attack
SIM Swapping Account Takeover
Attackers use data broker profiles and social engineering to convince mobile carriers to transfer a victim's phone number to a SIM card they control. Once in possession of the number, they intercept SMS-based two-factor authentication codes to gain access to banking, investment, and email accounts. High-net-worth individuals and cryptocurrency holders are the primary targets. The attack requires only publicly available personal information.
2FA Bypass Carrier Social Engineering High-Value Targets
Take Action

Your exposure profile
is already being built.

Every technique on this page uses data that already exists. LeakTrace finds it before an adversary acts on it.