System and method for facilitating data leakage and/or propagation tracking

A method for facilitating data leakage and/or propagation tracking on a network, the method being implemented on a computer system that includes one or more physical processors executing computer program instructions which, when executed, perform the method, the method comprising:

• obtaining, by the physical processors, a set of hashes that are associated with files of a user device, and a reference set of hashes that are associated with files of a reference system;
• determining, by the physical processors, an additional subset of hashes included in the set of hashes and not included in the reference set of hashes based on a comparison between the set of hashes and the reference set of hashes;
• classifying, by the physical processors, the user device into a group based on the additional subset of hashes comprising a hash that is the same as a hash associated with a file of at least another user device classified into the group;
• predicting, by the physical processors, that the file associated with the same hash is exclusive for the group to which the user device is classified;
• scanning, by the physical processors, one or more other user devices not classified into the group to determine what files are on the other devices;
• and
• generating, by the physical processors, an alert indicating unauthorized activity responsive to the scan indicating that the other user devices contain the file predicted to be exclusive for the group to which the user device is classified.