Technique
Data Breach Harvesting
Also known as: Credential Harvesting, Breach Data Mining, Leaked Data Exploitation, Combolist Acquisition, Database Dumping, Dark Web Data Sourcing
TARGETING
Collecting personal information from leaked databases to identify and profile potential victims.
Common attack flows
How it fits in a scam
This technique shows up duringTARGETING
Before
This is often where the scam begins.
Defense
How to defend against this
How to spot it
- Check Have I Been Pwned (haveibeenpwned.com) for email exposure in known breaches
- Monitor for unexpected password reset requests or account recovery notifications
- Watch for unsolicited contact that references accurate personal details
- Review credit reports for unfamiliar inquiries or fraudulent applications
- Track login attempts from unfamiliar locations or devices
- Be alert to personalized phishing that suggests prior data harvesting
Further reading
Malwarebytes
Overview of data breach attack vectors and credential stuffing connection
Malwarebytes
How breach data enables automated credential attacks
Malwarebytes
Breach data used for victim profiling in investment scams
Have I Been Pwned
Database of 943+ breached sites with 17B+ compromised accounts
Krebs on Security
Credential stuffing detection and service response