d4 · tools · leaks
Alerts for your watch list.
Tell us what to watch for and we will email you when a ransomware group claims it. Weekly at most, and only when something matches: a quiet week means no email at all.
What you are signing up to
- Claims, not breaches. An alert means a criminal group has said it holds data from something on your watch list. It is not confirmation that anything happened, and we never verify it. Groups invent victims and name suppliers as their customers.
- Weekly at most, and only when there is something. You are never told the same claim twice, and we do not send empty digests.
- Double opt-in. Entering your address here only triggers a confirmation email.
- Your watch list is yours. We store it because the filter cannot work otherwise. It is never shared, never used for anything else, and it is deleted the moment you unsubscribe rather than waiting for a retention sweep. We store a one-way hash of your IP address, never the address itself.
- Leaving is one click from any alert, and the whole record goes within 90 days.
Browsing the tracker itself stays anonymous: we do not record what anyone searches for. A subscription is different only because you have asked us to remember one thing, and told us where to send it.
See our privacy notice.