The Breach Was Someone Else’s. The Problem Was Yours.

In July 2018, HackNotice presented the internet with a modest invitation: make a list of the websites and companies you cared about, and it would tell you when one of them was hacked. The interface even called that list a “Hack Watchlist.” It was a pleasingly plain answer to a maddening question. If your details had escaped through a site you used once, who would tell you? The company’s answer was to watch for you.

Eight years later, the watchlist is still the right image, but the person holding the pen has changed. The customer is now often a security team, and the names on the list belong to suppliers. A payroll vendor, a cloud service, a partner with access to customer data: each can have a breach that becomes somebody else’s incident. HackNotice has built its business around the interval between the first external sign of trouble and the moment an affected organization can act on it.

The watchlist grows teeth

Founder and chief executive Steve Thomas came to this problem with a history in credential intelligence. He had founded PwnedList, a service concerned with exposed accounts, before working at SecurityScorecard. HackNotice’s public launch promised real-time monitoring for hacks and identity leaks, with free access for individuals. It gave users a reason to care about breach news that could otherwise feel like weather from another continent.

Michael Takla, who joined as co-founder and chief revenue officer in 2019, described the enterprise logic unusually clearly. The enterprise service had launched late the previous year, he wrote, and early customers had arrived. People reuse passwords. When a password appears in an unrelated breach, the employee’s company may acquire a problem it never directly caused. The leak happened elsewhere; the account takeover may happen here.

That progression matters because it turns an alert into a job. A notice on its own may be interesting, perhaps alarming. A notice connected to an employee account, customer login or critical supplier has an owner. The owner can reset a credential, block access, ask a supplier for details or investigate an attack. HackNotice’s current language is “operational adversary intelligence,” a grand phrase for a very practical aim: show the security team something it can use before a more formal disclosure arrives.

A bill for the awkward interval

The company raised a $7 million Series A in June 2022, led by Strategic Cyber Ventures with Lytical Ventures participating. At the time, it described itself chiefly as a company-wide threat awareness platform: teach employees about real threats and help them respond. In 2023 it added HackNotice Actions, which sends requests to breached companies on a person’s behalf. The request can ask what information was exposed or seek deletion of personal data; the user can track the reply. It is a small design admission with large consequences: telling someone their information has escaped is only the start of the work.

The newer enterprise pitch moves that lesson to security operations. HackNotice says it monitors ransomware leak sites, underground forums, breach datasets, criminal marketplaces and infostealer logs. The goal is to identify meaningful exposure affecting an organization or its vendors, enrich the signal, and send it to the people who can investigate. Its product pages also describe automated vendor questionnaires and AI-assisted summaries. These are the connective tissues between “a name appeared on a leak site” and “we contacted a supplier, checked our exposure and changed a control.”

Published customer stories give the abstraction a shape, though the customers are mostly unnamed. One case describes a large technology company monitoring thousands of vendors because waiting for supplier disclosures left gaps in its response. Another describes a large tech customer receiving 12 actionable alerts in a month through tailored, API-based notifications. A separate case groups a restaurant chain, a credit union and a bank around leaked consumer credentials: different businesses, same fear that a stolen login could be reused before anyone noticed.

Those examples are company accounts, not independently audited outcome studies. Their usefulness lies in the workflow they expose. A vendor may be monitored independently of its own reporting. An alert can be sent to the right internal system. A fraud team can act on a leaked consumer login without waiting for a customer complaint. The product succeeds or fails at the handoff, when someone decides whether a signal deserves attention.

What does the early warning cost?

HackNotice’s public pricing makes the business model unusually legible for this corner of cybersecurity. The company sells annual subscriptions, with different meters for vendor counts, employee coverage, research credits and investigation hours. Its published third-party monitoring plans give a useful sense of scale:

Published list prices for vendor monitoring; other services and custom packages are priced separately.

The price buys monitoring and workflow support, not the removal of every risk on a supplier list. It also reveals the buyer. A team with 50 vendors has a different operational problem from one with 1,000. The latter needs a way to rank alerts, route them, and remember what it did about each one. HackNotice’s differentiation rests less on claiming to be the only source of dark-web data than on attaching that data to people, companies and decisions. SecurityScorecard and other vendor-risk platforms offer alternatives; credential monitoring and broader threat-intelligence tools overlap with other pieces of the job.

The part worth stealing

A reader does not need HackNotice’s data collection machinery to borrow its most useful habit. Start with the list of suppliers and identities that could actually hurt the business if compromised. Decide in advance who receives a credible alert. Write down the first two actions for each kind of signal: verify the finding, then check what access or data the affected party has. Build a place to record the answer. Without that last step, a sophisticated feed produces a sophisticated pile of unread mail.

This approach has limits. External signals can arrive after the damaging act, and some breaches leave no public trace. A small organization with few vendors and a fast disclosure channel may need a simpler process. An alert stream without people available to validate and act on it can make the team slower, not faster. HackNotice’s own emphasis on fewer, higher-confidence signals is therefore less a marketing flourish than a condition for the product to be useful.

The company now presents AI-assisted investigation and automated assessments as the next stage. That may speed the work, but the real test remains remarkably old-fashioned: did the right person learn of a relevant problem in time to make a different decision? HackNotice began by asking which websites a person wanted to watch. Its grown-up question is harder, and better: when someone else is breached, how quickly can you tell whether it is yours to solve?