the only way is with deliberately feeding the system honeypot accounts where account activity is recorded, but even then it's only a tentative negative response

the only way is with deliberately feeding the system honeypot accounts where account activity is recorded, but even then it's only a tentative negative response ; it could just represent the time it takes for the data to be sold or otherwise perused. there are a few games out there that have this reputation-- third-party-ran nostalgic MMO private servers are a big example. the only defense that makes much sense is to virtualize that software and keep it away from sensitive data.