How do I investigate where personal information in a fraudulent email was leaked from?

Question

I have seen an email which is obvious from the content that it's a phishing/spurious email. However, the personal content is quite revealing and specific to that individual. How could I go about investigating how and where this personal data was 'leaked' from?

A sample of the content/text is:

Dear XXX, Invoice - HWNG6945RYVIZ
NAME SURNAME
1st Line of address
2nd Line of address
County
Postcode
Pass - 1234
I look forward to hearing from you,
Sender's Name

Also worth noting that there is a zip attachment to the email so that's a massive stand out No No that this is dodgy. However, as above the information they do contain is scarily accurate. So where did they get this from?

Answer 1

This could be related to almost anything, personal information are sold just like any other "things" on the darkweb and even on the "web" by relatively legal entities, Databrokers are selling personal information just like any other stuff.

In addition to this as @anon said OSINT tools might be used to gather information about persons, and there are lot of such tools (Shodan, Recon-ng, Foca, Maltego ...).

An other way also is the previous data breaches defined as:

"A data breach is a security incident in which sensitive, protected or confidential data is copied, transmitted, viewed, stolen or used by an individual unauthorized to do so."

You can check if you are victim of a previously known data breach using your email at Have I been pwned.

Hope it helped

Answer 2

One way to check for personal information is by using google. Just insert the string you want to search for and surround it with ". Like "NAME SURNAME". This will display some sites where exactly this match is found. You can check for other personal data from that mail, too. That way you propably can get close to the source of the information leakage.

There is a methodology called Google Dorking where you can get various information by just using google even if you do not have a concrete target. (see: https://en.wikipedia.org/wiki/Google_hacking) There are databases that contain a lot of these dorks. (see: https://www.exploit-db.com/google-hacking-database/)

Another thing to dig deeper in are OSINT (Open Source INTelligence) tools that gather such information from various databases among the internet. Most of these tools are publicly available and integrated in Kali Linux. (https://www.kali.org)

And some people like to look in the past to acquire such information from webservers that were publicly available and are now closed. One source for this information is: https://archive.org/search.php

And since I do not know who your "hacked" person was - It might be, that there are some publicly available social networks where you can get some data from (e.g. facebook, google+, twitter) or even his own homepage where his information are in the "contact"-section or available using whois.

Also consider that there is some person around the "hacked" one that knows those information and just told them to someone else without using super-secure cryptography to keep them private (or may be the attacker himself).

Last but not least there might be a chance where someone in your company leaks those information or is the attacker himself.

Although I hate to think of the last two points, I still think they are possible and probably hard to detect.

Answer 3

Your PI (personal information) is your PI, and in the 21st century you can't really avoid to spread it around everywhere. That means when someone has your PI it's hard to find out from where they might have gotten it. In some countries you have a legal right to ask companies to tell you, but that obviously only works if the source of the email is easily identifiable, which is usually not the case with phishers and other criminals.

What I do to identify leaks of my PI is to give every website I use a different email address. You can do that if you register an own domain name and then configure its email server to catch-all. That way all emails which arrive at that domain go to one mailbox and you don't need to create a new email account for every website. Yes, this costs money if you don't need a domain name with a mail server anyway, but not having to endure the advertisement and privacy infractions which come with most free email services is worth the price of admission alone, IMO.

So whenever someone asks me for my email address, I give them an address in the form [theirname]@[mydomain]. When someone wants to phish or spam me, they will usually do that to the email address which came with the dataset, so when I suddenly receive spam on an address which I only gave to a single website, I know who either lost or sold it.

A drawback of this scheme you need to be aware of is that registering a domain means to put your PI into the public WHOIS database. So anyone who realizes that you do this, can find your personal information from your email address. But fully automatic data-miners will usually not be able to connect these dots because they have no way to be sure that you are the only person who uses email addresses for that domain. But if you want to be safe, use a register-by-proxy service.

Answer 4

If you are worried that websites where you sign up are leaking your information, one possible way of tracing a leak is by signing up with slightly different names and email addresses to each website.

The easiest way to do this is by changing your middle name. So you would sign up to one website as John A. Djuro, to the next one as John B. Djuro, then John C. Djuro, and so on. The upside of this is that all mail sent to you should still reach you, but you will see when unsolicited mail or email arrives that contains the respective name you used.

For email addresses, you could use separate addresses for each site you sign up with. One possibility of doing this is by registering your own domain as suggested by @Philip in another answer. Also, some freemail providers allow you to modify your address and still receive all the messages. In the received message, you will then see the address to which the message is sent. For example, if you have a GMail account you can add a plus sign and any string you want to your address. So, if you own djuro@gmail.com, you could sign up with djuro+fishywebservice@gmail.com to some site and would still receive their emails. See GMail help here, the bottom section on "Use Gmail aliases".

However, once you have that information, there is not a lot that you can do with it. When confronted with the allegation of selling your data, no company in its right mind would confirm that they do it and you would probably have a hard time finding hard evidence against them. The only thing you can do is terminating your business relationship with them, but this will still not un-leak your personal information.

Answer 5

You can start looking at the topic such as digital footprints. For a simple start, you can google your name and ZIP code.

There are many ways that a person may leak their own information voluntary, i.e.

• Facebook (when you play with those "profile yourself as something" fake games)
• Linkedin (your name and company address)
• "FREE" contents subscription

Possible involuntary leaks:

• compromised online shop
• infected machine
• login through insecure Public WIFI

Answer 6

You don't.

I have a "send spam here" email address I use for precisely this reason. If I need to register at a site that feels the slightest bit spammy or dodgy, I give them that email, which I never read except to get at a specific message, i.e. the registration confirmation from the site.