Pre-data breach monitoring

Patent metadata

Field	Value
Publication number	US-11568348-B1
Application number	US-202117313775-A
Country	US
Kind code	B1
Filing date	May 6, 2021
Priority date	Oct 31, 2011
Publication date	Jan 31, 2023
Grant date	Jan 31, 2023

Abstract

A method for providing pre-data breach monitoring provides information to businesses that is useful to predict portions of the company data that may not be secured well enough and other risks associated with data breaches, such as employees that may not be trustworthy.

First claim

What is claimed is:

1. A computer-implemented method of monitoring online data to predict risk for data breach, the method comprising:
receiving a scan list comprising information regarding a plurality of individuals;
periodically automatically scanning a plurality of data sources for information regarding the plurality of individuals on the scan list, wherein the plurality of data sources that are automatically scanned include dark web data sources that are accessible via particular browsing software, wherein automatically scanning the dark web data sources comprises:
executing a particular browser that is configured to access dark address space that is not accessible via a standard browser configured to access public internet data sources; and
scanning at least a subset of the dark address space accessed via execution of the particular browser for at least a portion of data regarding the plurality of individuals on the scan list;

identifying a quantity of located data regarding the individuals across the plurality of data sources;
determining a difference between the quantity of located data and a quantity of located data identified in one or more previous scans of the plurality of data sources;
generating a data breach risk score based at least in part on the differences between the quantity of located data and the quantity of located data identified in the one or more previous scans; and
in response to determining that the difference between the quantity of located data and the previous quantity of data exceeds a threshold, providing a notification of a potential data breach.

2. The computer-implemented method of claim 1 , wherein the plurality of individuals are associated with a company.

3. The computer-implemented method of claim 1 , wherein the plurality of data sources further comprise the public internet data sources.

4. The computer-implemented method of claim 1 , wherein the dark web data sources are only accessible via the particular browsing software.

5. The computer-implemented method of claim 1 , wherein the notification comprises a data breach fraud score over time.

6. The computer-implemented method of claim 1 , wherein identifying the quantity of the located data is for each of a plurality of data breach risk categories, and determining the difference is for each of the plurality of data breach risk categories.

7. The computer-implemented method of claim 6 , wherein the data breach risk categories include at least one of: public internet, dark web, social media sites, sex offender databases, heath care, fraudulent activity sites, or fraud risk score.

8. The computer-implemented method of claim 1 , wherein the method further comprises:
periodically automatically scanning the plurality of data sources with respect to other individuals associated with each of a plurality of other companies, wherein the plurality of other companies are similar to the company in one or more categories, the one or more categories comprising at least one of a vertical market, a number of employees, or a geographic region; and
comparing the data breach risk score for the company to data breach risk scores determined for the plurality of other companies that are similar to the company.

9. The computer-implemented method of claim 1 , wherein the method further comprises: tracking the potential data breach to a particular data source holding a portion of data associated with one or more of the individuals on the scan list.

10. The computer-implemented method of claim 1 , wherein the method further comprises: tracking the potential data breach over time, and in response to determining that a change to the data breach risk score exceeds a threshold, generate another notification indicative of the change.

11. The computer-implemented method of claim 10 , wherein generating a data breach risk score comprises applying weights to different categories of information.

12. A computing system comprising:
memory; and
a hardware processor configured to execute computer-executable instructions to:
receive a scan list comprising information regarding a plurality of individuals;
periodically automatically scan a plurality of data sources for information regarding the plurality of individuals on the scan list, wherein the plurality of data sources that are automatically scanned include dark web data sources that are accessible via particular browsing software, wherein automatically scanning the dark web data sources comprises:
executing a particular browser that is configured to access dark address space that is not accessible via a standard browser configured to access public internet data sources; and
scanning at least a subset of the dark address space accessed via execution of the particular browser for at least a portion of data regarding the plurality of individuals on the scan list;

identify a quantity of located data regarding the individuals across the plurality of data sources;
determine a difference between the quantity of located data and a quantity of located data identified in one or more previous scans of the plurality of data sources;
generate a data breach risk score based at least in part on the differences between the quantity of located data and the quantity of located data identified in the one or more previous scans; and
in response to determining that the difference between the quantity of located data and the previous quantity of data exceeds a threshold, provide a notification of a potential data breach.

13. The computing system of claim 12 , wherein generating the data breach risk score comprises determining a plurality of data breach category risk scores that are each associated with a different data breach risk category of the data breach risk categories.

14. The computing system of claim 13 , wherein a first of the plurality of data breach risk categories is associated with the public internet data sources, and wherein a second of the plurality of data breach risk categories is associated with the dark web data sources.

15. The computing system of claim 13 , wherein a third of the plurality of data breach risk categories is associated with social media sources.

16. The computing system of claim 13 , wherein the data breach risk score is an average of the plurality of data breach category risk scores.

17. The computing system of claim 13 , wherein a first of the plurality of data breach category risk scores is weighted more heavily in determining the data breach risk score than a second of the plurality of data breach category risk scores.

18. A non-transitory computer storage medium which stores executable code, the executable code causing a computing device to perform operations that comprise at least:
receiving a scan list comprising information regarding a plurality of individuals;
periodically automatically scanning a plurality of data sources for information regarding the plurality of individuals on the scan list, wherein the plurality of data sources that are automatically scanned include dark web data sources that are accessible via particular browsing software, wherein automatically scanning the dark web data sources comprises:
executing a particular browser that is configured to access dark address space that is not accessible via a standard browser configured to access public internet data sources; and
scanning at least a subset of the dark address space accessed via execution of the particular browser for at least a portion of data regarding the plurality of individuals on the scan list;

identifying a quantity of loc

Assignees

• Consumerinfo Com Inc

Inventors

• Dean Michael John
• Kapczynski Mark Joseph

Classifications

• G06Q30/0205

  based on location or geographical consideration · CPC title

• G06Q50/265 Primary

  Personal security, identity or safety · CPC title

• G06Q50/01

  Physics · mapped topic

• G06Q10/105

  Human resources · CPC title

• G06F16/958

  Organisation or management of web site content, e.g. publishing, maintaining pages or automatic linking · CPC title