This is a fascinating read from security researcher Troy Hunt. In it he describes the process by which he investigates a data breach. Well worth the read.

https://www.troyhunt.com/a-data-breach-investigation-blow-by-blow/