Generating and monitoring fictitious data entries to detect breaches

1 . A tangible, non-transitory, machine-readable medium storing instructions that when executed by one or more processors effectuate operations comprising:

obtaining, with one or more processors, a fictitious data entry associated with a field present in a plurality of records associated with an online resource, wherein:

the fictitious data entry is generated based on a criteria used to generate non-fictitious data entries associated with the field in at least some of the plurality of records, wherein generating the fictitious data entry includes:

generating a first part of the fictitious data entry;

computing a second part of the fictitious data entry based on the first part,

the second part containing redundant information relative to the first part; and

conjoining the first part and the second part in the fictitious data entry,

the fictitious data entry is caused to be stored in at least some of the plurality of records in association with the field in a first set of one or more repositories to be monitored for breaches,

the fictitious data entry is different from the non-fictitious data entries, and

the fictitious data entry complies with a syntax of the non-fictitious data entries;

sending, with one or more processors, a query to a monitoring application, the query specifying the fictitious data entry and a request to determine whether a second repository of compromised data includes the fictitious data entry;

in response to the query, receiving, with one or more processors, query results indicating that the second repository of compromised data includes the fictitious data entry;

in response to the received indication that the second repository of compromised data includes the fictitious data entry, identifying, with one or more processors, at least some of the first set of one or more repositories that store the fictitious data entry;

designating, with one or more processors, other data entries within the at least some of the first set of one or more repositories as potentially having been breached; and

storing, with one or more processors, the designation in memory.

2 . The medium of claim 1 , wherein generating the fictitious data entry includes storing, in memory, a value indicative of a date on which the fictitious data entry was stored in the first set of one or more repositories.

3 . The medium of claim 2 , wherein the operations comprise:

in response to the received indication that the second repository of compromised data includes the fictitious data entry, accessing, with one or more processors, the value indicative of the date on which the fictitious data entry was stored in the first set of one or more repositories; and

inferring, with one or more processors, a date of a breach of the first set of one or more repositories based on the value.

4 . The medium of claim 3 , wherein within the at least some of the first set of one or more repositories as potentially having been breached comprises selecting a subset of records in the first set of one or more repositories and designating the subset of records as potentially having been breached based on the subset of records predating the inferred date.

5 . The medium of claim 2 , wherein the operations comprise:

identifying, with one or more processors, a previous fictitious data entry and a next fictitious data entry, the previous fictitious data entry being stored therein before the fictitious data entry, the next fictitious data entry being stored therein after the fictitious data entry, the previous fictitious data entry being deleted from the first set of one or more repositories in response to the storing of the fictitious data entry, and the fictitious data entry being deleted from the first set of one or more repositories in response to the storing of the next fictitious data entry;

in response to identifying the previous fictitious data entry and the next fictitious data entry, identifying, with one or more processors, a date and time on which the previous fictitious data entry was generated and a date and time on which the next fictitious data entry was generated;

in response to a received indication that the second repository of compromised data does not include the previous fictitious data entry and the next fictitious data entry at a time and date after the generation of the next fictitious data entry and in response to the received indication that the second repository of compromised data includes the fictitious data entry, determining a range of time during which the first set of one or more repositories has been breached, the range of time being between the time and date the fictitious data entry was stored in the first set of one or more repositories and the time and date the next fictitious data entry was stored in the first set of one or more repositories.

6 . The medium of claim 5 , wherein a subset of the other data entries within the first set of one or more repositories is identified based on the determined range of time.

7 . The medium of claim 1 , wherein the operations comprise:

identifying, with one or more processors, the first set of one or more repositories that stores the fictitious data entry;

in response to the identification of the first set of one or more repositories, identifying, with one or more processors, one or more respective additional fictitious data entries generated and stored in each of the first set of one or more repositories, the one or more respective additional fictitious data entries in each of first set of one or more repositories being distinct from each other;

sending, with one or more processors, another query to the monitoring application, the other query including the one or more respective additional fictitious data entries and a request to determine whether a repository of compromised data includes the one or more respective additional fictitious data entries;

in response to the other query, receiving, with one or more processors, other query results indicating whether the repository of compromised data includes one or more of the one or more respective additional fictitious data entries; and

identifying, with one or more processors, a subset of the first set of one or more repositories based on the other query results.

8 . The medium of claim 7 , wherein identifying the other data entries within the first set of one or more repositories includes identifying a subset of the other data entries within the subset of the first set of one or more repositories.

9 . The medium of claim 1 , wherein the fictitious data entry includes a set of user-authentication credentials comprising a first username and a first fictitious password and wherein the first username and the first fictitious password are generated based on the criteria used to generate other usernames and passwords.

10 . The medium of claim 9 , wherein:

designating comprises determining the first username and the first fictitious password has been breached; and

the operations comprise:

causing, with one or more processors, one or more users associated with the other usernames and passwords to be notified to change the other passwords; and

blocking, with one or more processors, access to one or more user accounts associated with the other usernames and passwords that have been breached.

11 . The medium of claim 1 , wherein:

the fictitious data entry includes at least one of a credit card number, a gift card number, or a voucher code and wherein the credit card number, the gift card number, or the voucher code is generated based on the criteria used to generate other credit card numbers, gift card numbers, or voucher codes for accessing the online resource; and

the operations comprise, in response to the indication that at least one of the credit card number, the gift card number, or the voucher code has been breached, causing, with one or more processors, one or more users associated with the other credit card numbers, other gift card numbers, or other voucher codes to be notified of the breach.

12 . The medium of claim 1 , wherein:

a set of rules specify whether a date entry in the field is valid; and

obtaining the fictitious data entry comprises:

determining more than a threshold number of characters for the fictitious data entry, the threshold number being specified by a rule of the set of rules;

determining a non-alphanumeric character for the fictitious data entry to comply with a rule of the set of rules;

determining a numeric character for the fictitious data entry to comply with a rule of the set of rules; and

determining a case of a character for the fictitious data entry to comply with a rule of the set of rules.

13 . The medium of claim 1 , wherein the operations comprise:

periodically generating, with one or more processors, a new fictitious data entry; and

storing the new fictitious data entry in the first set of one or more repositories.

14 . The medium of claim 1 , wherein:

before sending the query, respective hash values are computed based on entries in the second repository of compromised data; and

the fictitious data entry is determined to be included in the second repository of compromised data with operations including:

computing a hash value based on the fictitious data entry;

determining that the hash value based on the fictitious data entry matches one of the respective hash values based on entries in the second repository of compromised data; and

in response to the match, determining the fictitious data entry is included in the second repository of compromised data.

15 . The medium of claim 1 , wherein:

the fictitious data entry is generated using a generative machine learning model trained on a training set including non-fictitious data entries to distinguish fictitious data entries from non-fictitious data entries.

16 . The medium of claim 1 , wherein the operations comprise:

prior to storing the fictitious data entry within the first set of one or more repositories, determining, with one or more processors, that the fictitious data entry is distinct from other data entries stored within the first set of one or more repositories; and

in response to the determination that the fictitious data entry is not distinct from the other data entries stored within the first set of one or more repositories, generating, with one or more processors, another fictitious data entry based on the criteria used to generate the other data entries.

17 . The medium of claim 1 , wherein:

the fictitious data entry is determined to be different from the non-fictitious data entries based on a probabilistic data structure storing the non-fictitious data entries; or

that the second repository of compromised data is determined to include the fictitious data entry based on a probabilistic data structure storing the compromised data.

18 . The medium of claim 1 , wherein the operations comprise:

generating the fictitious data entry by violating one or more rules that determine a valid entry in the field.

19 . The medium of claim 1 , wherein the operations comprise:

steps for generating the fictitious data entry.