How Breach Data Cracks the Toughest Investigations | Ep. 107

In this episode of the NeedleStack podcast, hosts AJ Nash and Kacper Piwowar sat down with Matteo Tomasini, Founder & CEO of District4 Labs, for a masterclass on hard target investigations across the deep and dark web. Drawing on more than a decade of corporate investigations experience at firms like Prescient, BlueVoyant, and K2 Intelligence, Matteo walked through the layered methodology behind identifying threat actors — starting with public records aggregators like TLO, Accurint, and Clear, and expanding outward through breach data, social media, and internet infrastructure. His core message: every identifier is a lead, not a fact, and validation at every step separates real intelligence from garbage-in-garbage-out.

The conversation dug into the human side of adversary tradecraft. Matteo explained why even the most operationally disciplined threat actors eventually make mistakes — reusing a password, forgetting to launch a VPN, or leaving a footprint in a Minecraft account created when they were twelve years old. He shared how "pivoting through time" has helped him identify Russian hackers and other hard targets by exploiting the OpSec gaps of the past. AJ, Kacper, and Matteo also examined the industry's current tension around AI, platform consolidation, and the risk that newer analysts are becoming too dependent on tools that hide their methodology behind polished outputs.

The episode closed with a sobering discussion of provenance, chain of custody, and the growing threat of fabricated datasets — Matteo recounted receiving a Coinbase "leak" from a threat actor that turned out to be entirely synthetic, generated with a Python script. Whether the audience is corporate CTI teams racing to stop the bleeding or European law enforcement working under closure-rate pressure, the through-line is the same: show your work, deal in likelihoods rather than absolutes, and never trust a single data source without corroboration.

💡Name: Matteo Tomasini

💡Role: Founder & CEO

💡Company: District4 Labs

💡Noteworthy: Deep and dark web data company providing investigators and cyber analysts access to billions of records with compromised PII. Previously Managing Director and Cyber Practice Lead at Prescient, Director of Incident Response and Threat Intelligence at BlueVoyant, and Senior Practitioner at K2 Intelligence. Expertise spans deep and dark web investigations, social media intelligence, online threat monitoring, threat attribution, and complex cyber investigations.

💡Where to find them: District4 Labs, LinkedIn