Something not widely used are canary tokens: https://blog.thinkst.com/p/canarytokensorg-quick-free-detect...

The general idea is to insert some kind of bogus information into a system, with no links to other systems, and then trigger a notification if someone accesses it.