Skill: breach-data-analysis-specialist
Time: ~30 minutes

Goal

Use breach metadata to assess account takeover risk or corroborate a public email — not to weaponize private data.

Steps

1. Define question: “Was this account in breach X?” vs “What password?” — reject the second for Patriot use.
2. Use Have I Been Pwned-style APIs or org-approved tooling.
3. Record breach name, date, and classes of data disclosed (e.g. hashes vs plaintext — often unknown at summary level).
4. Recommend rotation and MFA in defensive reports.
5. Redact all secrets in notes.
6. If research touches non-public figures, obtain legal review before retention.

Pitfalls

• Paste dumps into chat tools — forbidden in most org policies.
• False negatives if email variants exist.

Next steps

• filing-effective-foia-requests.md