On 8 November 2018, a security tool inside Marriott International generated an alert. The alert was real. The breach it had detected had been running since 2014.
That year, Marriott acquired Starwood Hotels. The acquisition included Starwood’s entire guest reservation database. Buried inside it was a compromise that Starwood itself had apparently never detected. When Marriott’s security team finally traced the intrusion, they found that an attacker had kept persistent access to Starwood’s systems for four years. That access survived the ownership change, the data migrations, and the integrations. Approximately 383 million guest records were in scope: names, email addresses, phone numbers, passport numbers, Starwood Preferred Guest account details, and payment card information. The UK’s Information Commissioner’s Office fined Marriott £18.4 million in October 2020. That was reduced from an initial proposal of £99 million after Marriott showed co-operation and the economic disruption of the pandemic was taken into account. The fine could not undo four years of exposure.
The Marriott case sits at an extreme end of the detection timeline. But it is not an outlier in kind, only in duration.
TL;DR: Breaches take an average of 204 days just to detect (IBM), and some run for years. A once-a-year check with free public tools only catches breaches that are already public and widely circulated. It misses the 204-day window before disclosure, private-channel data that may never go public, and stealer logs entirely. Real continuous breach monitoring covers three channels near real-time: breach databases, paste sites, and dark-web markets.
In this article:
- The detection problem, by the numbers
- What happens to your data in that window
- What a once-a-year check actually catches
- Stealer logs and why they sit outside the breach framework
- What continuous monitoring actually looks like
- What to do now, in priority order
- Frequently asked questions
The detection problem, by the numbers
IBM’s Cost of a Data Breach Report, published annually in partnership with the Ponemon Institute, is the most widely cited source on breach timelines. The 2023 edition analysed 553 organisations across 16 countries and 17 industry sectors. Its finding on the mean time to identify a breach: 204 days. Mean time to contain it once identified: 73 days. Together, 277 days from initial intrusion to containment. Over nine months, across the industry average.
Equifax is instructive here. Attackers exploited a known Apache Struts vulnerability on 12 May 2017. Equifax did not discover the breach until 29 July 2017 — 78 days later. The company did not disclose it publicly until 7 September 2017. By then, the personal data of 147 million Americans had been exfiltrated, including Social Security numbers, birth dates, addresses, and driver’s licence numbers. The US Federal Trade Commission ultimately secured a $700 million settlement, the largest data breach settlement in US history at the time of signing. But the 78 days of undetected access were the window that mattered.
The 204-day figure is not driven by edge cases. It represents thousands of incidents averaged together, including many that were caught faster. Which means the incidents that pull the average upward — breaches that run for months or years, like Marriott — are considerably more common than they should be.
For individuals caught in those breaches, the timeline carries a secondary implication. GDPR requires organisations to notify the relevant supervisory authority within 72 hours of becoming aware of a breach. Notification to affected individuals must follow “without undue delay.” US state notification laws typically give companies 30 to 90 days from discovery. These timelines start when the company discovers the breach — not when the breach began. If discovery happens at day 204, the 72-hour regulatory clock starts at day 204. You may not receive a notification letter until day 270 or later. Your data has been circulating for the better part of a year before anyone tells you.
What happens to your data in that window
Stolen data does not sit idle. It moves through a fairly consistent pipeline from the moment of theft.
The first stage is high-value exploitation. Attackers who have just exfiltrated a large dataset typically mine it immediately for the most valuable records — complete credit card details with CVV, credentials to financial accounts, corporate logins. These are used directly for fraud or sold quickly to other criminals while they are fresh and potentially unknown to fraud prevention systems.
Prices on dark web marketplaces reflect the value gradient. Email-and-password combination records sell for a few cents each. Full credit card records with billing address and CVV fetch $8 to $20 per card on established markets. A complete “fullz” package — name, Social Security number, date of birth, and card details — ranges from $15 to $40. These figures come from breach intelligence firms including Comparitech and Digital Shadows, which publish periodic pricing surveys of dark web markets.
The second stage is bulk resale. Data that was not immediately exploited enters the market in bulk lots. A buyer might purchase 10 million records from a single breach to run credential stuffing campaigns. These are automated attempts to use email/password pairs from one breach to log in to unrelated services. This works because password reuse is endemic. SpyCloud’s 2023 breach exposure report found that 68% of users exposed in multiple breaches reused the same password across those incidents.
The third stage is wide circulation. Eventually, breach data filters down to free repositories. Paste sites, Telegram channels, and “combo list” archives aggregate breach data and make it available without charge. At this stage, the original breach is often years old — but the data is still usable for anyone who wants to run automated attacks.
The Adobe breach from October 2013, which exposed 153 million user records, serves as a benchmark for how long breach data persists in active use. Security researchers documented Adobe credentials appearing in credential stuffing attack logs as recently as 2021 — eight years after the breach. The data did not expire. Every account that was not remediated remained a valid attack surface.
What does a once-a-year check actually catch?
Most people become aware that their data has been compromised through one of four routes.
The notification letter is the slowest. It arrives after the company has discovered the breach, completed an internal investigation, notified regulators, and then dispatched individual notifications. By that point, the breach is typically months old.
Checking a public breach lookup tool — Have I Been Pwned being the most comprehensive free option — depends on the breach having been disclosed and indexed. HIBP ingests breach data when it becomes publicly available, either through voluntary disclosure or because a researcher or journalist has surfaced it. It does not index data that is circulating privately — on private dark web forums, in stealer log marketplaces, or in closed Telegram channels. Fresh breach data typically circulates for 12 to 24 months in closed channels before appearing anywhere public tools can reach.
Finding unauthorised charges on a card is reactive by definition. The fraud has already occurred. The alert you receive is the bank telling you your money has moved, not a warning that your credentials were exposed.
Account takeover is the worst outcome. You discover it when you can no longer log in, or when you receive an alert that your password was changed from a device you do not own.
An annual check using public tools covers exactly the segment of breach data that is already widely known. It misses data in the 204-day window between breach and disclosure. It misses data circulating on non-public channels that may never be publicly disclosed. And it misses the stealer log ecosystem entirely.
Stealer logs and why they sit outside the normal breach framework
The breach model assumes a company’s server is compromised and a database is exfiltrated. Infostealer malware operates differently. Redline, Vidar, and Raccoon — the main commercial families — infect individual devices and extract browser-saved passwords, session cookies, and autofill data at the point the user’s own machine. The exfiltration happens from your device, not from a company’s infrastructure.
The resulting “logs” are sold through dedicated marketplaces and Telegram channels. Genesis Market ran this model until the FBI’s Operation Cookie Monster seized it in April 2023. Russian Market, 2easy.shop, and multiple Telegram channels continue to operate on the same model. Logs are listed with previews: which sites the victim was authenticated to, whether active banking sessions were present, the date of exfiltration. A log with active corporate sessions sells for significantly more than a log containing only consumer accounts.
The credentials in a stealer log are not credentials from 2014 — they are passwords the victim used last week. The session cookies are active authentication tokens that bypass password protection entirely.
Public breach monitoring services, including HIBP, do not index stealer log data in the same way they index breach dumps, because the data structure is different. HIBP added stealer log coverage in 2023, flagging emails that appear in indexed logs, but the coverage is partial. Specialist services — SpyCloud, Hudson Rock’s Cavalier API — monitor stealer log marketplaces specifically. They represent a different monitoring requirement from breach database coverage: one focused on company-side compromises, the other on device-side compromises. Both channels require monitoring simultaneously.
What does continuous monitoring actually look like?
Meaningful monitoring covers three channels, and the alert timing matters as much as the channel coverage.
Breach database monitoring ingests new breach data as it is disclosed or discovered. This includes the service’s own indexed database, HIBP feeds where available through partnership, and direct partnerships with breach research organisations. Say a company reports 10 million records stolen, or a researcher discovers a dataset on a public-facing S3 bucket. That should trigger an alert within hours, not appear in a weekly summary.
Paste site monitoring covers Pastebin, Ghostbin, and similar services where credential dumps are posted shortly after being compiled. Paste sites are accessible to anyone and are crawled continuously by both security services and automated attack infrastructure. Data appearing on paste sites is typically already in active use. An alert at the moment of paste-site appearance still gives you a meaningful window to act before the data spreads further.
Dark web monitoring covers forums, marketplaces, and channels where fresh breach data is traded and stealer logs are sold. The depth of coverage here varies considerably between services. A service claiming “dark web monitoring” may be crawling a small set of publicly accessible forums. A deeper service indexes closed marketplaces and private channels, where the most valuable fresh data appears earliest.
Alerts should be near real-time. A weekly digest report is not monitoring — it is a delayed summary of events that may already be over. If a breach dataset containing your credentials is live and being actively used for credential stuffing, a same-day alert enables a password change within the highest-risk window. A report that arrives seven days later is primarily historical.
What to do now, in priority order
These steps are not theoretical risk management. They address specific, documented failure modes in the breach timeline.
Check all your email addresses against Have I Been Pwned today. Not just your primary address. Check every address you have used for account registrations, including old ones you no longer actively use. Old addresses remain in company databases and in breach data regardless of whether you still check them. Enable HIBP’s breach notification emails for each address.
Use a password manager with integrated breach monitoring. 1Password’s Watchtower checks stored passwords against known breach databases and flags compromised credentials automatically. Dashlane’s Dark Web Monitoring runs similar checks. Bitwarden’s built-in HIBP integration does the same. If a stored password appears in a breach, you want to know immediately, not at your next annual review.
Activate real-time transaction alerts on every card and bank account. Most UK and US banks offer push notifications for any card transaction above a threshold you set. Set the threshold to £0/£0. A same-day alert when your card number is used fraudulently is a fundamentally better position than discovering it on your monthly statement.
Place a credit freeze with all five credit bureaus. Most UK and US guidance mentions three US bureaus: Equifax, Experian, and TransUnion. There are five. NCTUE (National Consumer Telecom and Utilities Exchange) handles identity checks for utility accounts and telecoms. ChexSystems is used by most banks for new current account applications. Innovis is smaller but used by several lenders. A freeze on only the major three leaves doors open that are regularly used in identity fraud. A freeze costs nothing in the US under federal law and prevents new credit being opened using your information regardless of what breach data exists.
Check your email forwarding rules once a month. A compromised email account frequently has forwarding rules installed silently. Every email you receive is then also copied to an address the attacker controls. The password reset for your bank account that you never requested may have already been intercepted this way. In Gmail: Settings → See all settings → Forwarding and POP/IMAP. In Outlook: Settings → View all Outlook settings → Mail → Forwarding.
For fuller coverage, use a service that monitors stealer log marketplaces. This is the channel that public breach tools do not cover. SpyCloud operates at enterprise level. Consumer-facing services with stealer-log coverage are available at lower price points. KnytX Shield is built to cover this alongside breach monitoring and paste-site coverage once it launches. The reason this matters is simple. If your device was infected with infostealer malware and your credentials are being sold on Russian Market, no standard breach alert will reach you. Only stealer-log-specific monitoring will.
The breach you haven’t heard about yet
The Marriott breach ran for four years. The Equifax breach ran for 78 days. Neither company knew while it was happening.
The 204-day average is not a technology problem that will be solved by better enterprise security tooling alone. Some fraction of it will improve as detection tools mature. But the distribution of breach timelines is fat-tailed. A small number of very long-running compromises pull the average up. Those long-running compromises tend to be the ones with the most data exposed and the most harm caused.
Checking once a year, with free public tools, catches data from breaches that are already publicly known and already have circulated widely. It is better than nothing. It is not monitoring.
The window that matters is the one between breach and disclosure. That’s the 204 days when data is actively trading and the company does not yet know it has been compromised. Real-time alerts, across all three channels, are the mechanism for closing that window. Everything else is catching up after the fact.
Frequently asked questions
What is continuous breach monitoring? It’s near real-time watching of three channels for your data: breach databases, paste sites, and dark-web markets. It aims to alert you within hours of a leak, instead of a yearly or after-the-fact check.
Why isn’t a yearly Have I Been Pwned check enough? HIBP only indexes breaches once they’re public. It misses the 204-day pre-disclosure window, private-channel data, and most stealer logs. A yearly check catches what’s already widely known, not what’s actively being traded.
What are stealer logs, and why do they matter? Stealer logs come from malware on your own device, not a company server. They contain fresh passwords and active session cookies. Standard breach tools index them poorly, so they need dedicated monitoring.
Can I do continuous monitoring for free? Partly. Enable HIBP notifications, bank transaction alerts, and password-manager breach checks today. Full stealer-log and dark-web coverage usually needs a paid service. Also check whether your details already sit on people-search sites.
What you can do right now
Want to see what data brokers expose about you? See what a scan finds → shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will monitor breaches, paste sites, and dark-web markets for your data automatically. Join the waitlist to get in early.