A targeted attack rarely starts with an exploit. First the attacker collects what is openly available about the company and its people: work addresses in public commits, numbers in profiles, usernames an employee uses both on a forum and in work tools, passwords from old breaches. These are the same open sources Oracul works with. The difference is who looks first.
What to look for
- Breaches for employees' work and personal emails, and which fields they expose: passwords, hashes, phones.
- Emails that ended up in public commit metadata on GitHub.
- Phones and addresses employees put in public profiles themselves.
- Usernames reused across many sites: material for login guessing and for phishing in the name of a familiar service.
- Public channels and posts where employees talk about internal systems.
The breached_credentials flag
If an email is in breaches with passwords, the scan signals carry breached_credentials. For security that is a concrete action: check whether the password is reused in corporate systems, force a change, turn on a second factor. Breach checks use the public XposedOrNot database and are available on paid plans.
Pentest and red team
The same reconnaissance is the first stage of an agreed penetration test. Oracul covers it in minutes: employee usernames, reused emails, public profile data and the link graph. The key condition is scope: run scans only on people and targets the client of the test explicitly agreed to.
Legal basis and quiet
Checking your own employees is still processing personal data. The basis and the notice procedure depend on your jurisdiction and internal policies, so settle them before the first scan. The scan itself is quiet: no password resets and no emails, so the check creates no stray notifications and does not alarm anyone.
What to do with the result
- Change passwords found in breaches and turn on a second factor where it is missing.
- Remove work addresses from public commits: set up a private commit email.
- Ask employees to hide work phones in public profiles.
- Use the reused usernames in anti-phishing training.
- Erase scans after the review with DELETE /v1/scans/{id}; otherwise they are deleted after 30 days.