SpyCloud's Recaptured Identity Data
Making raw data recaptured from breaches, malware-infected devices, and successful phishes actionable to stop cyberattacks
SpyCloud continuously ingests and analyzes more than 25 billion pieces of stolen identity data every month – delivering the most severe exposure data in minutes for rapid remediation.
The data we recapture is the same data criminals are using to fuel targeted cyberattacks, so it is the most valuable information for defenders.
Our focus extends beyond exposed credentials to include stolen cookies and personally identifiable information (PII) tied to individuals across their many online personas so you can stop threats tied to holistic digital identities.
It’s the most comprehensive approach to blocking identity-based cybercimes, including account takeover, session hijacking, ransomware, and online fraud.
HOW IT WORKS
Our Engine
SpyCloud built and maintains the industry’s largest collection of breach, malware-exfiltrated, and successfully phished data, which powers automated ATO, ransomware, session hijacking, and online fraud prevention solutions. But our engine goes beyond data collection. After we acquire each digital asset, it is put through a rigorous quality control process to determine its value. We cleanse and parse the datasets, crack passwords and further enrich the data to then correlate it to individual user identities across their multiple online personas to determine their true risk to your enterprise.
The result is actionable insights relevant to your business that you can act on quickly – via integrations into your existing security stack – to shut down cyberattacks.
Collect – The world's largest collection of recaptured data
We rapidly collect stolen and leaked assets from the darknet containing user credentials, cookies, and high-value PII such as first and last names, addresses, phone numbers, dates of birth, SSNs, credit card numbers and much more. This type of data can be used by criminals to easily impersonate users and harm individuals and businesses.
Our collection methods use a combination of security research and automated technology. Our team of researchers have been performing this type of tradecraft for years and are the most capable in this area. Critical information is recaptured by our researchers very early in the attack timeline, often within days of a data breach, malware infection, or successful phish occurring. In many cases, we are the first to inform the affected victim organizations through our responsible disclosure process. These efforts create the world’s largest, continuously updated repository of information gathered from breaches, malware victim logs, successful phishes and other underground sources.
Curate – Remove noise and extraneous alerts
The engine parses and normalizes petabytes of unstructured data, discarding records that do not contain passwords or high-value PII. It compares each record to the billions of assets already in our database. We end up discarding about 60% of the files we collect as duplicates from past breaches that have been repackaged as combolists. This ensures that our customers are not inundated with extraneous alerts.
Through this process, SpyCloud manages more than 240 distinct attributes collected directly from darknet records that are machine-readable and immediately actionable.
Enrich – Robust context, cracked passwords, more insights
SpyCloud goes further than any other vendor to enrich the recaptured data with supporting contextual information including the source, breach description, and the actual breached password. We have invested heavily in “de-hashing” collected passwords, allowing customers to determine whether exposed credentials exactly match the in-use credentials for their employees and customers. This process lets us provide more than 90% of collected passwords in plaintext, making our data analytics the most actionable in the industry.
In the case of malware-exfiltrated data, SpyCloud provides all relevant context including the machine ID, IP address, infected date and time, and infection path, as well as target URLs, credentials, and cookies for critical workforce applications that have been siphoned and are in criminals’ hands. Acting quickly to invalidate this information with Post-Infection Remediation is crucial for stopping malware infections from becoming full-blown ransomware incidents.
Analyze – Identity–centric risk correlation
Our engine draws correlations across billions of records that have been stolen and distributed by criminals, revealing a comprehensive view of your employees’ and consumers’ identities and online behaviors. This allows more confident decisions on whether to enable access, reset passwords, use enhanced authentication, or monitor accounts for suspicious activity. On average, if exposed once, an email address appears 8-10 times in our dataset. By linking these individual appearances across multiple data breaches, malware infections and successful phishes, we deliver unique insights about your users’ holistic risk of account takeover, synthetic identity, and fraud tied to exposed data.
Automate – Drive action to protect digital identities
SpyCloud’s insights are accessible in our products, including APIs that can be embedded into your workflows and applications or via integrations to popular SIEMs, SOARs, IdPs, EDRs, and TIPs to protect your enterprise from criminals using stolen information to impersonate your users’ identities.
The new way to fight cybercrime
SpyCloud turns the tables by making darknet data work for you. We detect when your employee and customer credentials, cookies, PII and other critical stolen assets are in the hands of cybercriminals and automate remediation to reduce your risk of cyberattacks.
Recaptured
Assets
Breaches
Malware
Families
See the data we have on your domain. Discover breach and malware exposures, stolen cookies, password reuse and more.
Interested in integrating SpyCloud data to enhance your solution?
