SKILL / Infrastructure
Plans: Pro & AgencyBreach Exposure Search
Research authorized exposure records for an identifier while keeping credentials redacted.
Read the step-by-step user guideBreach Exposure Search answers whether an email address, username, phone number or similar identifier appears in authorized records of data exposures, which incidents it is associated with and when. Investigators use it to assess a subject’s or an organization’s exposure, to explain how an account might have been compromised, or to connect an identifier to the aliases and services that appear alongside it. Nexus returns the findings as evidence-linked records, each naming the exposure, its date and the fields present, with credentials and other sensitive values redacted.
What you get
Redacted findings showing where an identifier appears in exposure records, with dates and sources attached.
Using Breach Exposure Search in an investigation
Redaction is a feature, not a limitation. Passwords, hashes and similar secrets are never displayed; what the investigator sees is that a field existed, which is enough to establish exposure and assess risk without handling the secret itself. Each finding is labeled by the strength of the identifier match, so an exact email match and a partial username match are not presented as equivalent. Identifiers that appear in no records are reported as an information gap rather than as proof of a clean history.
Exposure findings can be added to the case graph as identifier and incident entities, cross-referenced with Public Profile Discovery and Public Username Discovery to test whether a co-occurring alias belongs to the same subject, and cited in a brief or PDF report with the evidence record attached. Every use should be lawful and proportionate to the investigation; Nexus supports authorized research into exposure, not access to anyone’s accounts.
Example objectives
Run the Skill directly, or describe the objective in your own words — these are the kinds of questions it is built to answer.
Ask Nexus
“Does this email address appear in any exposure records, and which incidents and dates are involved?”
Ask Nexus
“Which usernames and services appear alongside this identifier in exposure records?”
Ask Nexus
“Was this company’s domain affected by known data exposures, and which fields were involved?”
How Breach Exposure Search fits the investigation
A Skill is one move inside a case. The findings stay in the case file, where the evidence behind them can be checked, graphed and reported.
- 01
Choose or describe
Pick the Skill from the Skill Library, or describe the objective in your own words and let Nexus work out which Skills fit the question.
- 02
Review the evidence
Open the evidence record behind any finding and read the original public source before you rely on what it says.
- 03
Add to the case graph
Promote the people, organizations and identifiers you accept into the case relationship graph, straight from their evidence records.
- 04
Brief and report
Turn the case into a BLUF situation brief and, on Pro and Agency, into a structured PDF report with chain of custody.
Evidence before conclusions
What Breach Exposure Search cannot establish
Nexus keeps supported findings, possible matches, contradictions and information gaps apart instead of blending them into one narrative. These are the boundaries Breach Exposure Search states up front.
- A matching identifier does not by itself establish who currently controls the account or that the subject owned it at the time of the exposure.
- Results reflect the authorized records available to Nexus; absence from the results does not mean an identifier was never exposed.
- Credentials, hashes and other secrets stay redacted; Nexus documents that a field existed and does not reveal or verify its value.
Best for
Teams that reach for Breach Exposure Search most often.
Related OSINT concepts
The vocabulary this Skill works in, defined in the glossary.
Related Skills
Skills investigators commonly run next, in the same case.
Frequently asked questions
What does Breach Exposure Search return for an identifier?
Breach Exposure Search in Nexus returns the exposure records in which an email address, username, phone number or similar identifier appears, with the name and date of each incident, the categories of fields that were present and the other identifiers found alongside it. Every finding is linked to its evidence record, and the strength of the match is labeled so an exact match is not confused with a partial one.
Will Breach Exposure Search show me passwords?
Breach Exposure Search does not show passwords, hashes or other secrets. Nexus redacts those values and reports only that the field was present in the record, which is enough to document exposure and assess risk. The redaction protects the people whose data was exposed, keeps the investigation lawful and ensures the case file never contains material that could be misused if the report is shared.
Which Nexus plan includes Breach Exposure Search?
Breach Exposure Search is included in the Skill Library on the Pro and Agency plans. Pro unlocks 43 of the 47 investigative Skills, including Breach Exposure Search; the companion Breach Pattern Analysis Skill is Agency-only, and the Agency plan includes all 47 Skills.
Does an exposure record prove the subject owns the account?
An exposure record does not prove that the subject owns or controls the account. Identifiers are reused, sold, mistyped and shared, and a record shows only that the identifier appeared in a particular exposure on a particular date. Breach Exposure Search reports the match with that caveat, and Nexus lets the investigator corroborate ownership with public-profile evidence before treating the account as the subject’s own.