Breached Databases

Overview

Breached databases represent collections of user information exposed through security incidents at various websites, services, and organizations. These breaches may affect millions of users and can contain highly sensitive personal and account information.

Characteristics

Origin: Data obtained from publicly disclosed breaches of websites, applications, and services
Scale: Can range from small incidents affecting thousands of users to massive breaches impacting hundreds of millions
Age: Historical breaches dating back several years to recently disclosed incidents
Validation: Each breach is verified and normalized before being added to our system

Breach Data Structure

Breached database records typically include:

Breach Metadata: Information about the breach itself, including the affected organization, breach date, and publication date
User Identifiers: Primary identifiers such as email addresses, usernames, or phone numbers
Personal Information: Various personal details depending on what the breached service collected
Authentication Data: Password hashes or, in some cases, plaintext passwords if they were stored insecurely

Data Points

Breached databases can contain numerous data points, including email addresses, passwords, names, addresses, phone numbers, and more. The specific data points available depend on the nature of the breached service and what information it collected from users.

Personal Information

Key	Description	Type	Rules	Example
email	Email address	String	Minimum Length: 5, Regex: email_re	[email protected]
name	Full name	String	Minimum Length: 2	John Louis Smith
firstname	First name	String	Minimum Length: 2	Tarik
middlename	Middle name	String	Minimum Length: 2	Maria
lastname	Last name	String	Minimum Length: 2	Johnson
ssn	Social Security number	Number	Minimum Length: 5	19254587
gender	Gender	String	Either Male or Female	Male
phone	Phone number	String	Minimum Length: 5	12163547758
phone_partial	Partial phone number	String	Minimum Length: 3	324-XXX-4798
date_of_birth	Date of birth	String	Minimum Length: 3	2000/06/30
date_of_birth_day	Day of birth. Concatenated to date_of_birth and removed from data row	String	Minimum Length: 1	30
date_of_birth_month	Month of birth. Concatenated to date_of_birth and removed from data row	String	Minimum Length: 1	6
date_of_birth_year	Year of birth. Concatenated to date_of_birth and removed from data row	String	Minimum Length: 4	2000
nationality	Nationality	String	Minimum Length: 2	Welsh
age	Age	Number	Minimum Length: 1	23
identification_document_no	Identification document’s number	String	Minimum Length: 5	925668006

Password

Key	Description	Type	Rules	Example
password	Plain password	String	Minimum Length: 3	xF$42uwDBPaT
password_hash	Hashed password	String	Minimum Length: 15	8743b52063cd84097a65d1633f5c74f5
salt	Salt	String	Minimum Length: 1	M5aq
encrypted_password	Encrypted password	String	Minimum Length: 5	COQLCE6DU6GtcS5P=
password_hex	Password in hex format	String	Minimum Length: 7	HEX[“6c616261733434”]
password_b64	Password in base64	String	Minimum Length: 7	bGFiYWRpZW5hMQ==
b64_runs	Number of runs needed to decode base64 value	Number	Minimum Length: 1	2
security_question	Question for users authentication	String	Minimum Length: 3	In what city were you born?
security_answer	Answer to a security question	String	Minimum Length: 3	New York City
password_hint	Hint for passwords recalling	String	Minimum Length: 2	Ignorance

Education

Key	Description	Type	Rules	Example
education	Education level	String	Minimum Length: 5	Master’s Diploma
university	Universities name	String	Minimum Length: 2	UCLA
faculty	Faculties name	String	Minimum Length: 2	Faculty of Law
school	School’s name	String	Minimum Length: 2	Pine Street School

Location

Key	Description	Type	Rules	Example
locale	Area or place, especially one where something special happens	String	Minimum Length: 2	Prospect Park
location	Location	String	Minimum Length: 3	Amsterdam Ave
country	Country	String	Minimum Length: 1	Belgium
state	State	String	Minimum Length: 2	WI
city	City	String	Minimum Length: 2	Naples
address	Address	String	Minimum Length: 3	139 Smith St
zip	Postal code	Number	Length between 3 and 15	45784
longitude	Longitude	String	Minimum Length: 1	2.349014
latitude	Latitude	String	Minimum Length: 1	48.864716
timezone	Time zone	String	Minimum Length: 3	EST

Social Media

Key	Description	Type	Rules	Example
aim	AIM	String	Minimum Length: 3	kirtlee
msn	MSN	String	Minimum Length: 3	[email protected]
facebook	Facebook	String	Minimum Length: 5	lance.makrity
facebook_page	Facebook profile’s URL	String	Minimum Length: 5, Regex: url_re	facebook.com/NewCarsSL
twitter	Twitter	String	Minimum Length: 2	JamesLinch
linkedin	LinkedIn	String	Minimum Length: 5, Regex: url_re	linkedin.com/in/malcolmdevine
im	IM	String	Minimum Length: 2	demonnex
icq	ICQ	Number	Minimum Length: 3	615782486
yahoo	Yahoo	String	Minimum Length: 3	hyliandee
skype	Skype	String	Minimum Length: 3	monsskert
stackoverflow	Stack Overflow	String	Minimum Length: 3	ultimwaa
github	GitHub	String	Minimum Length: 3	jawwop
youtube	YouTube	String	Minimum Length: 5, Regex: url_re	youtube.com/cvuliana
vkontakte	VK	String	Minimum Length: 5, Regex: url_re	vk.com/donremenov
homepage	Homepage’s URL	String	Minimum Length: 5, Regex: url_re	tomcars.com/contacts
discord	Discord user name	String	Minimum Length: 5	RainbowFist#8136
instagram	Instagram user name or URL	String	Minimum Length: 3	mthy.cecilia
telegram	Telegram user name or URL	String	Minimum Length: 3	Thanghm12
social_media	Other Social Media profile’s URL	String	Minimum Length: 5, Regex: url_re	instagram.com/kerryxaq
follower_count	Amount of followers a user has	Number	Minimum Length: 1	654

Physical Features

Key	Description	Type	Rules	Example
height	Height	Number	Minimum Length: 1	187
weight	Weight	Number	Minimum Length: 2	75
race	Race	String	Minimum Length: 3	Black
ethnicity	Ethnicity	String	Minimum Length: 1	Irish
shoe_size	Shoe size	Number	Minimum Length: 1	9
eye_color	Eye color	String	Minimum Length: 1	Hazel
hair_color	Hair color	String	Minimum Length: 1	Blonde
blood_type	Blood type	String	Minimum Length: 1	AB

Finance

Key	Description	Type	Rules	Example
cc	Credit Card number	Number	Length between 15 and 17	4321587844443698
cc_expiration	Credit Card expiration date	String	Length between 4 and 12	11/24
cc_expiration_month	Credit Card expiration month	String	Length between 2 and 8	Nov
cc_expiration_year	Credit Card expiration year	String	Length between 2 and 4	2024
cvv	Credit Card security code	Number	Length between 3 and 5	943
vat_number	Value Added Tax number	String	Minimum Length: 8	IT14144778996
bank_account_number	Bank account’s number	String	Minimum Length: 3	55743513
bank_name	Banks name	String	Minimum Length: 3	Quontic Bank
paypal	Paypal account’s email	String	Minimum Length: 5	[email protected]
currency	Currency	String	Minimum Length: 2	EUR
affiliate_code	Code for conversion tracking and affiliate marketing clicks	String	Minimum Length: 3	3kaQ5rg
credit_rating	Estimate of the ability of a person to fulfil their financial commitments	String	Minimum Length: 1	AA
income	Sum that includes any wage, salary, profit, interest payment, rent, or other form of earnings	Number	Minimum Length: 3	2500
salary	Fixed regular payment	String	Minimum Length: 3	1750
bitcoin_address	Unique identifier, serves as a virtual location for cryptocurrency	String	Length between 24 and 36	3FZbgi29cpjq2GjdwV8eyHuJJnkLtktZc5
ethereum_address	Unique identifier, serves as a virtual location for cryptocurrency	String	Length between 40 and 42	0x1289dD9831a96e49b2C73c3C8431FF349AbCd123

Vehicle

Key	Description	Type	Rules	Example
driver_license_id	Driver’s license ID	Int	Minimum Length: 5	18745899
vehicle_license_plate	Vehicle’s license Plate	String	Minimum Length: 2	ACC8789
vehicle_vin	Vehicle’s VIN (Vehicle Identification Number)	String	Length: 17	1HGBH41JXMN109186
vehicle_make	Vehicle’s Manufacturer	String	Minimum Length: 2	Hyundai
vehicle_model	Vehicle’s Model	String	Minimum Length: 1	Carrera
vehicle_color	Vehicle’s Color	String	Minimum Length: 1	Navy Blue
vehicle_date	Vehicle’s manufacture date	String	Minimum Length: 3	2016/11/11

Other

Key	Description	Type	Rules	Example
username	Username	String	Minimum Length: 2	treyzLawl
ip	Internet Protocol address	String	Minimum Length: 5, Regex: ipv4_re, ipv6_re	146.204.189.1
cf_email	Email address in CloudFlare’s format	String	Minimum Length: 10	[email protected]
alternate_email	Parent email address	String	Minimum Length: 5, Regex: email_re	[email protected]
company_name	Companies name	String	Minimum Length: 3	Blue Planet
employer	Employer’s full name	String	Minimum Length: 3	Dylan King
language	Language	String	Minimum Length: 3	English
profession	Profession	String	Minimum Length: 5	Baker
bio	Biography	String	Minimum Length: 15	Rapid and sustainable user growth is my true passion
profile_picture	Profile picture’s URL	String	Minimum Length: 5, Regex: url_re	images.fineartamerica.com/picture.png
imei	IMEI (International Mobile Equipment Identity)	Int	Length between 14 and 16	356938035643809
imsi	International Mobile Subscriber Identity (IMSI)	Int	Length between 14 and 15	310170845466094
api_key	API (Application Programming Interface) key	String	Minimum Length: 3	zaCELgL.0imfnc8mVLWwsAawjYr4Rx-Af50DDqtlx
device_type	Device’s type	String	Minimum Length: 2	Personal Computer
device_hardware_id	Set of numbers and letters that uniquely identifies the device (HWID)	String	Minimum Length: 6	03000102030405060708090a0b0c0d0e0f
maritalstatus	Marital status	Boolean	Minimum Length: 1	0
relationship_status	Relationship status	String	Minimum Length: 3	Married
mother_maiden_name	Mother’s maiden name	String	Minimum Length: 2	Jouland
family_member_name	Family member’s full name	String	Minimum Length: 2	Cousin

Data Example

Below is an example of what leaked database data might look like:

Leaked database example

Security Implications

Database breaches pose significant risks including:

Account Takeover: Exposed credentials can lead to unauthorized access across multiple services due to password reuse
Identity Theft: Personal information can be used to impersonate individuals for fraud
Targeted Phishing: Detailed personal information enables highly convincing targeted attacks
Reputation Damage: Organizations associated with breaches often suffer significant reputational harm

API Access Methods

The NordStellar Dark Web API provides multiple ways to access breached database information:

Direct Lookups

Query for specific identifiers using the /email/{email-sha256} or /phone/{phone-sha256} endpoints
Get detailed database information using the /data-source/database/{id} endpoint
Lookup breached databases by domain using the /data-source/database/domain/{domain} endpoint

Bulk Operations

Check multiple email addresses in a single request using the /email (POST) endpoint
Retrieve information about multiple databases using the /data-source/database (POST) endpoint

Domain-Wide Assessment

Use the /email/domain/{domain} endpoint to identify all email addresses affected in a specific domain
Get domain-wide statistics using the /email/domain/statistics/{domain} endpoint

Use Cases

Security Monitoring

Monitor for new breaches affecting your organization's domain
Identify which types of data were exposed in breaches
Assess the severity of breaches based on exposed data points

User Protection

Alert users when their credentials appear in breaches
Force password resets for accounts with compromised credentials
Provide guidance based on the specific data types exposed

Compliance and Reporting

Generate comprehensive breach reports for regulatory compliance
Document the specific data types exposed in breaches
Track breach timeline and affected user statistics

By leveraging the breached databases information through the NordStellar Dark Web API, organizations can gain valuable insights into their security posture, protect their users from the consequences of data breaches, and respond effectively when incidents occur.

Malware Infections Credential Lists