Grants staff find an applicant's email in a public breach-lookup service. What is the appropriate OSINT finding to report?
Select an answer to reveal the explanation.
Short Explanation
A breach lookup is a smoke detector, not a spare key. It tells you the address showed up in a public dump. It does not give grants staff permission to try leftover passwords on city systems.
Full Explanation
Public breach-lookup services can show that a grant applicant’s email appeared in a dump; the appropriate civic OSINT finding is an exposure report about that identifier—without replaying leaked secrets against city or grant systems. Grants staff need risk context and applicant advisories, not a miniature penetration test performed under an OSINT label. Replaying associated leaked secrets against the grant portal is unauthorized access and may violate computer-crime and acceptable-use rules even when framed as “verification.” Cracking remaining hashes as a pentest deliverable for the grants office exceeds PORP scope and typical civic authorization boundaries. Emailing the leaked secret to the applicant for written confirmation spreads credentials further and creates new exposure in the grants correspondence file. Exam caveat: PORP permits citing public dump presence as exposure intelligence while forbidding credential replay and cracking as collection methods. Operational check: record dump name, approximate date, and identifier only; redact secrets from the grants memo; recommend resets through official channels; and refuse any request to test leaked passwords on city or grant systems.