Breach and leak intelligence
Criminals reuse emails like everyone else. Glacier21 finds where.
The email on a scam account was often used somewhere else first, and that somewhere else may have leaked. Glacier21 links an email, phone number, username or IP address to leaked records and shows the exact chain of records that connects it to a wallet. It is powerful, so it is deliberately hard to misuse.
From a search
An email search that ends at a wallet.
Search an email and Glacier21 shows the web pages it appeared on and the leaked records that connect it, hop by hop, to an identity holding a wallet. Each related email and phone is graded by how strongly it connects.
- Hops between the search and the wallet
- Strong and medium connections marked
- An intelligence-use notice on screen
The evidence board
See every record between the search and the wallet.
The evidence board lays out the chain: the searched value, each leaked record it appears in, the identity those records point to and the wallet that identity holds. The source breach and date are on every record, so the reasoning is on the page, not in someone's head.
- Source breach and date on every record
- Pin findings straight into a case
- Logged to the case it was run for
What you can search
Start from the identifier your case gave you.
Six starting points, each traced through leaked records toward a wallet.
Email addresses
Phone numbers
Usernames
IP addresses
Rare password hashes
Wallets
Weighing the lead
Know how much a connection is worth before you chase it.
A breach connection is a lead to corroborate, not proof. Glacier21 grades each one and flags the values that would mislead you.
Strong and medium connections
Common values flagged
Every hop shown
Access controls
Built to be powerful and hard to misuse.
Breach data is sensitive, so access is narrow, deliberate and recorded at every step.
Granted, never assumed
Access needs two keys: Glacier21 enables it for your organization, and for each member who needs it.
Seat holders only
Only investigators holding a paid seat can use it. Viewers and case guests cannot run breach lookups.
A notice, every day
Each user accepts an intelligence-use notice before searching, and accepts it again every 24 hours.
Every lookup logged
Each lookup is logged with the account and the case it was run for. A daily cap limits volume per user.
Kept out of URLs
Searched values are sent in the request body, so they never land in a URL, a browser history or an access log.
Pins carry a reference, not the record
A breach finding pinned into a case stores a hashed reference, not a copy of the leaked record.
Silence when locked
Without access, Glacier21 never hints at whether breach data exists for a value.
FAQ
Questions about breach intelligence.
What is breach and leak intelligence?
It links a searched value, or a wallet, to records from third-party data breaches and leaks. Criminals reuse emails, phone numbers and usernames like everyone else, so a leaked record often connects an anonymous wallet to an identity.
What can I search?
Email addresses, phone numbers, usernames, IP addresses and rare password hashes. From a wallet, you see the breach exposure of the identity behind it.
Who can use it?
Teams that Glacier21 has granted access to, and within them only the members granted access who hold a paid investigator seat. Every user accepts an intelligence-use notice before searching.
Is breach data proof of identity?
No. Treat a breach connection as a lead to corroborate, not as proof. Each connection is graded and common values are flagged to help you weigh it.
Is every lookup recorded?
Yes. Each lookup is logged with the account that ran it and the case it was run for, and there is a daily cap per user.
How do I get access?
Breach intelligence is enabled per organization. Request a demo and we will walk you through it and the access process.
Find out where the email was used before.
Get a live walkthrough of breach intelligence on real data, from a searched email to the wallet behind it, and how access works for your team.
Keep reading