Skip to content

Alert types

The alert type tells you what kind of thing was found.

Type What was found Typical first step
Password A plaintext password for one of your accounts. Reset it and check for reuse.
Password hash A hashed password. Reset it.
API key A key or token that grants access to a service. Revoke and reissue.
Email An email address at your domain in a breach, with nothing else of yours. Note it, and watch for phishing.
Username An account name tied to your organisation. Check for reuse across services.
Sensitive data Documents, records or other confidential material. Assess what it contains and who is affected.
Third party A finding about one of your third parties that concerns you. Ask them what happened.
Ransomware Your organisation or a third party named by a ransomware group. Escalate within your organisation.
Dark web A mention of your organisation on the dark web or a forum. Read the evidence and assess whether it is credible.
Other Anything that does not fit above. Read the description.
  • Password: someone has your actual password in readable form. Anyone who finds it can sign in as you.
  • Password hash: a scrambled form of a password. It cannot be read directly, but weak scrambling can be undone, so treat it as exposed.
  • API key: a code that lets software act on your behalf, without a login screen.
  • Dark web: your organisation is being discussed on hidden sites. Typically this is your data offered for sale, someone asking to buy access to you, or a ransomware group announcing a breach.
  • Ransomware: a criminal group has publicly claimed an attack on you or on one of your third parties, usually on their own leak site. Either they are threatening to release the stolen data unless they are paid, or they have already released it.

Each alert shows you what was exposed, where it was found, a description of the finding, the impact on you and a suggested remediation. Where it is technically possible, Oko includes a screenshot of the source, for example the forum post.