Apparatus are provided that include a communication circuit, monitoring circuit, and an alert circuit and a method is provided that includes receiving at least a portion of a protected set of files including a tripwire file and at least one normal file, the at least one normal file including a number of attributes, and the tripwire file lacking an attribute of the at least one normal file; and detecting a sign of an activity related to the tripwire file of the protected set of files, wherein the protected set of files includes a protected database, the protected database including the at least one normal file and the tripwire file; and generating a signal indicating an unauthorized activity related to the protected set of files in response to the detected sign of an activity related to the tripwire file.