Employee credentials in a stealer log
An infostealer on an employee's personal device exfiltrated credentials and an active session cookie for the corporate VPN portal. The record surfaced inside a bulk sale package on …
4 modules
High
Example scenario
Third-party risk through a supplier breach
The supplier's customer portal was leaked. The published dataset included API keys, webhook URLs and technical contact emails.
- Case no
- IG-UC-2026-003
- Threat
- A software supplier's database was leaked and contained the organisation's integration keys.
- Sectors
- Banking & finance, Public sector, Telecommunications
- Roles
- CISO, IT Operations
- Outcome
- Key rotation started on the day the leak was published.
The InsightGuard approach
The supplier was on the monitored third-party list. When the leak was published the dataset was scanned against the organisation's domains and key formats; matching records landed straight on its board.
Timeline
Situation → Outcome
-
Supplier added to monitoring
Contracted suppliers are added to the monitored third-party list.
-
Leak published
The dataset is published on a ransomware leak site.
-
Key match
The parsed dataset contains the organisation's webhook URLs and API key prefixes.
-
Rotation
Affected keys are revoked and integrations re-established with new keys.
-
Supplier review
The case closes as an input to the supplier risk assessment.
Related files
Typosquatted domain with a fake login page
Shortly after appearing in certificate transparency logs, the freshly registered domain began serving a copy of the organisation's login page that posted credentials to a third-party server.
3 modules
Exposed admin panel on a forgotten subdomain
A subdomain left running after a marketing campaign ended stayed up on an outdated CMS version, with its panel exposed to the internet.
3 modules
Next step
What shows up on your own surface?
In a 30-minute session we run a live scan against your own domains.