Systems and methods of determining compromised identity information

A computer-implemented method comprising

• receiving, at the interface, encrypted PII data from a compromised entity, wherein the encrypted PII data is associated with the compromised entity;
• disassociating elements of the encrypted PII data from the compromised entity and from each other;
• unencrypting the PII data;
• re-encrypting the PII data to produce re-encrypted PII data, wherein re-encrypting the PII data includes independently encrypting each data filed using a different encryption key;
• storing, at the memory, the re-encrypted PII data as compromised PII data in the memory, the stored compromised PII data disassociated into unlinked fields such that the unlinked fields of the compromised PII data cannot be correlated by anyone other than a holder of a mapping key that maps identity elements of the compromised PII data to each other;
• receiving, via the interface, a PII request with submitted PII data for comparison to the compromised PII data;
• determining a risk score based at least in part on the result of the comparison, wherein the risk score reflects a probability that an element of the encrypted PII data received from the compromised entity may be misused;
• and
• providing the risk score to the compromised entity, wherein the risk score is used to change a decision by the compromised entity.

A computer-program product tangibly embodied in a non-transitory machine-readable storage medium of a gateway device, including instructions configured to cause one or more data processors to perform operations including:

• receiving, at the interface, encrypted PII data from a compromised entity, wherein the encrypted PII data is associated with the compromised entity;
• disassociating elements of the encrypted PII data from the compromised entity and from each other;
• unencrypting the PII data;
• re-encrypting the PII data to produce re-encrypted PII data, wherein re-encrypting the PII data includes independently encrypting each data filed using a different encryption key;
• storing, at the memory, the re-encrypted PII data as compromised PII data in the memory, the stored compromised PII data disassociated into unlinked fields such that the unlinked fields of the compromised PII data cannot be correlated by anyone other than a holder of a mapping key that maps identity elements of the compromised PII data to each other;
• receiving, via the interface, a PII request with submitted PII data for comparison to the compromised PII data;
• determining a risk score based at least in part on the result of the comparison, wherein the risk score reflects a probability that an element of the encrypted PII data received from the compromised entity may be misused;
• and
• providing the risk score to the compromised entity, wherein the risk score is used to change a decision by the compromised entity.