Identifying stolen databases

A computer system for identifying a hacked database, comprising:

• one or more processors, one or more computer-readable memories, one or more computer-readable tangible storage medium, when executed by the one or more processors, and program instructions stored on at least one of the one or more computer readable tangible storage medium by at least one of the one or more processors via at least one of the one or more computer readable memories, wherein the computer system is capable of performing a method comprising:
• generating a marked account, wherein the marked account contains data that imitates a customer account;
• initiating a first transaction using the generated marked account, wherein the first transaction is initiated to store the marked account on a service provider database, wherein the marked account is stored with customers data on the service provider database;
• determining that an attempted second transaction has occurred using the generated marked account, wherein the attempted second transaction is initiated by an unauthorized user, wherein the marked account is identified when the unauthorized user initiates the attempted second transaction, wherein the attempted second transaction indicates that the service provider database is compromised, wherein the unauthorized user compromised the service provider database to access the customers data;
• tracing a marked account location to identify a specific service provider database that was compromised, wherein tracing the marked account identifies a specific set of customers data that was compromised, wherein the specific set of customers data that was compromised is determined by identifying the time period between the first transaction and the second transaction;
• and
• alerting a service provider that the specific service provider database has been compromised.

A computer program product for identifying a hacked database, comprising:

• one or more computer-readable storage medium and program instructions stored on at least one of the one or more computer readable storage medium, the program instructions when executed by one or more processors, comprise:
• program instructions to generate a marked account, wherein the marked account contains data that imitates a customer account
• program instructions to initiate a first transaction using the generated marked account, wherein the first transaction is initiated to store the marked account on a service provider database, wherein the marked account is stored with customers data on the service provider database;
• program instructions to determine that an attempted second transaction has occurred using the generated marked account, wherein the attempted second transaction is initiated by an unauthorized user, wherein the marked account is identified when the unauthorized user initiates the attempted second transaction, wherein the attempted second transaction indicates that the service provider database is compromised, wherein the unauthorized user compromised the service provider database to access the customers data,
• program instructions to trace a marked account location to identify a specific service provider database that was compromised, wherein tracing the marked account identifies a specific set of customers data that was compromised, wherein the specific set of customers data that was compromised is determined by identifying the time period between the first transaction and the second transaction;
• program instructions to alert a service provider that the specific service provider database has been compromised.