A system for detecting unauthorized attempts to access critical data stored on a monitored resource and alerting an owner or custodian of said monitored resource about such attempts, the system comprising: a local protection backup file system in communication with said monitored resource and configured to control access to and usage of critical backup files for said monitored resource; a local collector system comprising collector agents configured to read technical data from monitored resources and to send technical data to one or more local collection extractor modules; said local collection extractor modules configured to collect technical data from agents and send data to a central system; a geo-location collector system comprising geo-location agents installed on user devices configured to read geo-location data from user devices and to send geo-location data to geo-location extractor modules; said geo-location extractor modules configured to collect geo-location data from geo-location agents and send data to a central system; a central system management module in communication with the local protection backup file system, the local collection extractor modules, and the geo-location extractor modules, said central system management module comprising a system database, an analysis and extrapolation system, and an alerting system, the system database including a temporary dataset for collected data processing, personal authentication data for owners, PADO, of monitored resources; a theoretical authentication data request, TADR, dataset for all new connections on monitored resources; and a technical dataset for rules and configurations; the analysis and extrapolation system comprising: a collector engine configured to receive information from local collector systems, and to aggregate and extrapolate data associated with the received information, and an analysis engine that detects non-authorized access to critical data based on a type analysis processor to identify type of data, data stream processors to build profile, to geocode and to send data to the associated data store; and a Functional & Extrapolation rules processor; and the alerting system configured to communicate with the analysis and extrapolation system and to send messages to owners of monitored resources. a local protection backup file system in communication with said monitored resource and configured to control access to and usage of critical backup files for said monitored resource; a local collector system comprising collector agents configured to read technical data from monitored resources and to send technical data to one or more local collection extractor modules; said local collection extractor modules configured to collect technical data from agents and send data to a central system; a geo-location collector system comprising geo-location agents installed on user devices configured to read geo-location data from user devices and to send geo-location data to geo-location extractor modules; said geo-location extractor modules configured to collect geo-location data from geo-location agents and send data to a central system; a central system management module in communication with the local protection backup file system, the local collection extractor modules, and the geo-location extractor modules, said central system management module comprising a system database, an analysis and extrapolation system, and an alerting system, the system database including a temporary dataset for collected data processing, personal authentication data for owners, PADO, of monitored resources; a theoretical authentication data request, TADR, dataset for all new connections on monitored resources; and a technical dataset for rules and configurations; the analysis and extrapolation system comprising: a collector engine configured to receive information from local collector systems, and to aggregate and extrapolate data associated with the received information, and an analysis engine that detects non-authorized access to critical data based on a type analysis processor to identify type of data, data stream processors to build profile, to geocode and to send data to the associated data store; and a Functional & Extrapolation rules processor; and a collector engine configured to receive information from local collector systems, and to aggregate and extrapolate data associated with the received information, and an analysis engine that detects non-authorized access to critical data based on a type analysis processor to identify type of data, data stream processors to build profile, to geocode and to send data to the associated data store; and a Functional & Extrapolation rules processor; and the alerting system configured to communicate with the analysis and extrapolation system and to send messages to owners of monitored resources.