# Our data is on a leak site. Can we find out when it was stolen?

Often, if the logs from that time still exist. The published files give clues: their newest modification date sets the earliest possible theft date, and the folders they came from point to the servers involved. Then look in your firewall, proxy and cloud audit logs for large outbound transfers from those servers around that time, and for the first regular contact with an unknown outside server, which often marks the start of the intrusion. Ask your incident-response provider to do this, and do not download the leaked data from the site yourself: involve your responder and lawyer, because handling stolen data carries its own risks. Report the publication to the police. NetSenX keeps alerts for unusual outbound volume per host, with time and destination, for your plan's alert history, which can narrow the window considerably.

FAQ: [Incident response](https://netsenx.com/en/faq/incident) · https://netsenx.com/en/faq/our-data-is-on-a-leak-site-when-was-it-stolen

## Read next

- https://netsenx.com/en/detect-ransomware-on-the-network
- https://netsenx.com/en/nis2-incident-reporting-deadlines

## Related questions

- [Does NetSenX record which files were exfiltrated?](https://netsenx.com/en/faq/does-netsenx-record-which-files-were-exfiltrated)
- [Do attackers come back after we clean up?](https://netsenx.com/en/faq/do-attackers-come-back-after-cleanup)
- [What is incident response?](https://netsenx.com/en/faq/what-is-incident-response)
- [What are the phases of incident response?](https://netsenx.com/en/faq/what-are-the-phases-of-incident-response)
- [How do we prepare for a cyber incident before it happens?](https://netsenx.com/en/faq/how-to-prepare-for-a-cyber-incident)