About


Scattered Secrets disrupts cybercrime. We protect you and your organization from account takeover ('ATO') and fraud. We can also help your organization to comply with password related rules and regulations like NIST 800-63B and NIS 2.

Most people use the same password for multiple accounts.
Cyber criminals collect data leaks and crack leaked password information.
Found passwords are used to login on other services and takeover your accounts.
Compromised accounts are used to steal money, information and to start ransomware attacks.

Credential Stuffing

above: cyber criminal at work

We collect data leaks and stealer logs.
We extract and crack passwords.
You can keep your employee and customer accounts safe.

Scattered Secrets is a true password breach notification service. Well-known services like Have I Been Pwnd do not process passwords, resulting in many false alarms. In most cases an alert just means that your email address is in a SPAM list and no passwords were stolen. Most cyber threat intelligence companies do not actively crack passwords: they show raw data only. We are best in class in cracking passwords. This allows us to generate unique quality content and to eliminate false positives.


You can use our unique high quality data for protecting employee and customer accounts. For example, you can recover the plain text passwords using a web interface, or fully integrate password re-use checks using our API.

Scattered Secrets BV was founded in 2017 and is located in Amsterdam, The Netherlands (EU). We have got a Big Four background and many years of experience in information risk management, incident response and penetration testing.

Services


PERSONAL PROTECTION
protect individual email accounts
prices including VAT (if applicable)

FREEno expiry

Community

  • PERSONAL USE
  • 0 domains
  • 1 email
  • no alerts 
€2per email per year

Basic

    /
  • PERSONAL USE
  • 0 domains
  • 1 or more emails
  • email alerts


ENTERPRISE PROTECTION
protect domains & emails (for VIPs)
prices excluding VAT (if applicable)

€2,500per year

Pro Bronze

  • <1,500 FTE
  • unlimited domains 
  • 50 VIP emails 
  • email alerts
€20,000per year

Pro Silver

  • 1,500-15,000 FTE
  • unlimited domains 
  • 250 VIP emails 
  • email alerts
€50,000per year

Pro Gold

  • >15,000 FTE
  • unlimited domains 
  • 1,000 VIP emails 
  • email alerts


AUTOMATED ATO PROTECTION
keep customer accounts safe

Credential Stuffing

above: preventing account takeover by blocking leaked passwords

Protect your customer or internal accounts with our unique Scattered Secrets BreachCheck API:
Fast and easy-to-implement.
No application code updates required.
No access to plain text passwords required.
Protect any kind of IAM system.
Protect all accounts, also if they're not frequently used.
Privacy friendly and GDPR proof.

So no new dependencies or cumbersome integration projects. You don't share sensitive information with us. And you can protect both standard systems like Active Directory and custom solutions.


Do you want to verify the real-life exposure of your accounts using a proof of concept? You can. Just compile a test dataset and we will provide you with clear and fact based risk metrics for your organization.

BreachCheck can also be used during incident response in case of an ongoing credential stuffing attack. We can outpace the attackers and provide you with a list of vulnerable accounts, so you can contain and eliminate the attack as soon as possible.

Pricing of our BreachCheck API is based on the number of accounts you would like to protect and environment specific characteristics. Are you interested in details? Or would you like to discuss options for custom integrations for your specific use-case? Please feel free to contact us.



PASSWORD AUDIT
identify weak passwords

Using smart strategies, hardware that excels in a specific job and billions of passwords of experience, we can help you to uncover leaked and other weak passwords used within your organization.


Password audits can be performed on a regular basis to keep your accounts safe. We support a wide variety of password hashing algoritms. Are you interested in details or would you like to discuss non-standard solutions? Please contact us.


Media


Credential stuffing and password cracking explained. From bit to board.

Interested in a subject? Click the picture for details!

Contact


We are friendly people and like to help.
If you prefer secure email, get our PGP key.


Dataleaks


  • focus on quality data, real threats only
  • no tricks to show the highest numbers
  • unique dataleaks: 4,753 
  • unique passwords: 7,800,305,485 
  • find out if a specific site was breached below