Data Leaks

Data Leaks#

Reference catalog of consequential data leaks an operator should recognize. Leaks differ from breaches in origin: an insider, a whistleblower, a source, or an exposed misconfiguration releases the material rather than an external intruder taking it. Many of the entries below reshaped journalism, intelligence policy, or the way platforms talk about transparency.

For lookup of a specific leak, use the references at the end. For working caches of historical leaks, DDoSecrets and the ICIJ project are the standard reference archives.

By Name (A-Z)#

Leak	Records	Target	Source	Ngrams for searching
Afghan War Diary	91,731 reports	ISAF / coalition operational reports	Chelsea Manning via Wikileaks	“afghan war diary wikileaks 2010”, “manning afghan logs”
BlueLeaks	269 GB	Multiple fusion centers, police unions (see campaign table)	“Anonymous” via Distributed Denial of Secrets (DDoSecrets)	“blueleaks 2020 DDoSecrets”, “netsential blueleaks fusion”
Cablegate (Wikileaks)	251,287 cables	State Department diplomatic cables	Chelsea Manning via Wikileaks	“wikileaks cablegate 2010”, “manning state department cables”
China Cables (Xinjiang)	400+ pages	Xinjiang Public Security Bureau (internal directives)	Anonymous source via ICIJ	“china cables xinjiang ICIJ 2019”, “xinjiang public security leak”
DNC Leak	19,252 emails / 8,034 attachments	Democratic National Committee	“Guccifer 2.0” / GRU Unit 26165 (Russia-attributed) via Wikileaks	“DNC leak 2016 wikileaks”, “guccifer 2.0 DNC emails”
Discord Leaks (Pentagon)	hundreds of classified slides	Pentagon / DoD daily intelligence briefs	Jack Teixeira (Air National Guard)	“pentagon discord leak 2023”, “jack teixeira OG slides”
Equation Group (Shadow Brokers)	exploit toolkit + implants	NSA Tailored Access Operations (TAO)	“Shadow Brokers” (attributed to insider + Russia-adjacent activity)	“shadow brokers equation group 2016”, “EternalBlue NSA leak”
Facebook Files	tens of thousands of internal docs	Meta / Facebook (internal research)	Frances Haugen (whistleblower) via WSJ	“facebook files frances haugen 2021”, “wsj facebook files”
FinCEN Files	2,121 SARs	Financial Crimes Enforcement Network (suspicious activity reports)	BuzzFeed News / ICIJ via anonymous source	“fincen files 2020 ICIJ”, “fincen SAR leak buzzfeed”
Hacking Team	400 GB	HackingTeam SRL (Italian surveillance vendor)	“Phineas Fisher” (single intruder, claimed)	“hacking team 2015 leak”, “phineas fisher hacking team”
Iraq War Logs	391,832 reports	Multinational Force-Iraq operational reports	Chelsea Manning via Wikileaks	“iraq war logs wikileaks 2010”, “manning iraq SIGACTs”
LuxLeaks	28,000 pages of tax rulings	PwC Luxembourg / ~340 multinationals	Antoine Deltour (PwC employee) via ICIJ	“luxleaks 2014 deltour”, “luxembourg tax rulings ICIJ”
Mauritius Leaks	200,000 documents	Conyers Dill & Pearman (offshore law firm)	Anonymous source via ICIJ	“mauritius leaks 2019 ICIJ”, “conyers dill pearman leak”
Offshore Leaks	2.5M files	Portcullis TrustNet, Commonwealth Trust Ltd.	Anonymous source via ICIJ	“offshore leaks 2013 ICIJ”, “portcullis trustnet”
Pandora Papers	11.9M files	14 offshore service providers (see campaign table)	Anonymous source via ICIJ	“pandora papers 2021 ICIJ”, “offshore service providers leak”
Panama Papers	11.5M files (2.6 TB)	Mossack Fonseca (Panamanian law firm)	“John Doe” via ICIJ	“panama papers 2016 mossack fonseca”, “ICIJ panama John Doe”
Paradise Papers	13.4M files	Appleby + Asiaciti Trust + 19 corporate registries	Anonymous source via ICIJ	“paradise papers 2017 ICIJ”, “appleby asiaciti paradise”
Pentagon Papers	7,000 pages	DoD historical study of Vietnam policy	Daniel Ellsberg via NYT and others	“pentagon papers 1971 ellsberg”, “pentagon papers NYT”
Snowden Disclosures	~1.7M documents (per official est.)	NSA / Five Eyes SIGINT programs	Edward Snowden (contractor) via Greenwald / Poitras / Guardian / Spiegel	“snowden NSA 2013”, “PRISM XKeyscore snowden”
Suisse Secrets	18,000 accounts	Credit Suisse private banking	Anonymous source via Süddeutsche Zeitung / OCCRP	“suisse secrets 2022 credit suisse”, “OCCRP credit suisse leak”
Swiss Leaks (HSBC)	60,000 accounts (~$100B AUM)	HSBC Private Bank (Suisse)	Hervé Falciani (IT employee)	“swiss leaks HSBC 2015 falciani”, “falciani HSBC private bank”
Trove of Trump Tax Returns	6 years of returns	The Trump Organization / personal returns	Anonymous source via NYT	“trump tax returns NYT 2020”, “trump tax leak six years”
Twitter Files	thousands of internal docs / Slack threads	Twitter / X (pre-acquisition decisions)	Internal release via Elon Musk to Matt Taibbi, Bari Weiss, others	“twitter files 2022 taibbi”, “twitter files weiss musk”
Vault 7	8,761 files	CIA Center for Cyber Intelligence (capabilities)	Joshua Schulte (CIA developer) via Wikileaks	“vault 7 wikileaks 2017”, “joshua schulte vault 7”
Vault 8	source code (Hive C2)	CIA “Hive” command and control framework	Joshua Schulte via Wikileaks	“vault 8 hive wikileaks”, “CIA hive source code”
Vulkan Files	5,299 pages	NTC Vulkan (Moscow IT contractor for FSB / GRU)	Anonymous source via Süddeutsche Zeitung / Spiegel / Le Monde	“vulkan files 2023 NTC vulkan”, “FSB GRU vulkan contractor leak”

Multi-Target Campaigns#

BlueLeaks (2020)#

Target	Notes
Netsential (web host)	Patient-zero compromise via web platform vendor.
251 law-enforcement and fusion-center sites	The aggregate document trove.
Northern California Regional Intelligence Center (NCRIC)	Heavily quoted.
Boston Regional Intelligence Center (BRIC)	Heavily quoted.
Joint Regional Intelligence Center (Los Angeles)	Heavily quoted.
National Fusion Center Association	Membership-wide exposure.
18 association/training partners	Including IACP and IADLEST archives.

Pandora Papers (2021)#

Target (offshore provider)	Notes
Alemán, Cordero, Galindo & Lee (Alcogal)	Panama; ~15K beneficial owners exposed.
Asiaciti Trust	Singapore.
Trident Trust Group	Multi-jurisdiction.
SFM Corporate Services	Switzerland.
Demerara Bank (via providers)	Guyana exposure.
Fidelity Corporate Services	BVI.
Il Shin	South Korea.
CIL Trust International	Belize.
Commence Overseas	BVI.
Overseas Management Company	Panama.
All Round Consultants	Hong Kong.
14 service providers, 330 politicians, 130 billionaires	The aggregate dataset (ICIJ summary).

Search Queries#

OSINT entry points for hunting a specific leak, the source’s attribution, and the downstream reporting.

Hosted archives#

Archive	Pattern
Wikileaks	`https://wikileaks.org/` (search by collection name).
ICIJ Offshore Leaks DB	`https://offshoreleaks.icij.org/` (entity / officer search).
DDoSecrets	`https://ddosecrets.com/article/<leak-slug>`
The Intercept (Snowden)	`https://theintercept.com/snowden/`
Cryptome	`https://cryptome.org/` (early publishing archive).
National Security Archive	`https://nsarchive.gwu.edu/` (declassified docs).

Google / Bing dorks#

Goal	Dork
Primary publication	`"<leak>" intext:"leak" site:nytimes.com OR site:theguardian.com OR site:icij.org`
Document-set search	`"<leak>" intext:"documents" filetype:pdf`
ICIJ database hits	`"<entity>" site:offshoreleaks.icij.org`
Wikileaks PDF	`"<leak>" site:wikileaks.org filetype:pdf`
Court / sealed-docket lookup	`"<source>" site:courtlistener.com OR site:pacer.gov`
DOJ release on source	`"<source>" site:justice.gov`

Source / leaker attribution#

Goal	Query
Whistleblower profile	`"<source>" interview profile site:newyorker.com OR site:propublica.org`
Indictment / charging docs	`"<source>" indictment filetype:pdf`
Lawyer / defense team	`"<source>" defense attorney site:lawfaremedia.org OR site:emptywheel.net`
Sanctions / extradition	`"<source>" extradition site:state.gov`

Entity / document pivot#

Goal	Query
OCCRP coverage	`"<entity>" site:occrp.org`
Bellingcat verification	`"<entity>" site:bellingcat.com`
Specific document hash	`"<sha256>" cryptome wikileaks ddosecrets`
Mirror archives	`"<leak>" filetype:torrent OR filetype:zip`

References#

Wikileaks, primary publisher for Manning / Snowden-adjacent disclosures and Vault 7 / 8.
ICIJ, International Consortium of Investigative Journalists. Hosts Panama / Paradise / Pandora / Mauritius / Offshore Leaks indexes.
DDoSecrets, distributed transparency collective; hosts BlueLeaks, Vulkan Files, and other archives.
OCCRP, Organized Crime and Corruption Reporting Project; primary partner on Suisse Secrets and others.
The Intercept, primary outlet for Snowden disclosures.
Süddeutsche Zeitung, lead outlet for Panama / Paradise / Pandora / Vulkan releases.
Data Breaches, intrusion-driven incidents (compare).
Hacking, techniques used to enable leaks.
Intelligence Agencies, agencies named in disclosures.