Client: European Banking Group (SOC, CTI & SecOps Teams)
Area: cybersecurity – Dark Web monitoring and data leak identification
Integration: keyword-based monitoring + expert analysis by PREBYTES SIRT
Result: increased visibility of external threats and the ability to respond before an incident occurs
The bank had well-developed system protection mechanisms and mature incident response processes. However, it lacked visibility into what was happening with data related to the organization outside its infrastructure.
In practice, this meant that potential threats could emerge and evolve externally, without the ability to detect them early.
As part of the implemented Dark Web Investigation service provided by PREBYTES SIRT (Security Incident Response Team), a database published on a cybercriminal forum was identified early on. It contained login credentials, passwords, and information about the services from which the data originated.
Among the records were email addresses in the bank’s domain, linked to various services such as cta.pl, gateway.hbogo.pl, gandalf.com.pl, and krakow-biblioteka.sowa.pl.
Importantly, the data did not originate from a single incident but from multiple independent breaches, indicating broad exposure of employees outside the organization.
The key question was not “has a breach occurred?” but rather “if and how can this data be used against our organization?”
The implemented Dark Web Investigation service is based on a set of keywords associated with the bank – primarily employee email domains and other organizational identifiers.
Monitoring covers, among others, TOR, Freenet, and I2P networks, cybercriminal forums, and underground marketplaces. In practice, this means continuous scanning of a wide range of sources for data related to the organization.
When such information is detected, its source and scope are identified – particularly the type of exposed data and the services it is associated with.
The bank receives insights that enable its security teams to assess whether the data can be used in practice – for example in login attempts, phishing campaigns, or social engineering attacks.
The key value of the service lies in providing an early signal of data exposure outside the organization.
Based on these early risk signals, SecOps teams can instantly prioritise incident remediation, trigger automated force-resets for compromised accounts, and initiate targeted step-up authentication.
The most significant change was gaining real visibility into how data related to employees functions outside the organization.
Identified leaks were no longer treated as isolated incidents but as potential entry points for further malicious activity. The approach shifted from reactive (after an incident) to proactive (before it occurs).
It is also worth emphasizing that the scope of monitoring is not limited to employee email addresses. The service also includes identification of data related to the organization in a broader context – including information about customers, suppliers, and mentions of the institution itself.
This makes it possible to detect not only individual leaks but also broader patterns and potential attack vectors that may impact the security of the entire organizational ecosystem.
Are your employees’ data already for sale? Verify your exposure on the Dark Web: Dark Web Investigation | Uncover stolen data on the Darknet | PREBYTES
