1. A system for using file hashes to track data leakage and document propagation in a network, comprising: a network having multiple user devices; one or more active scanners configured to scan the multiple user devices in the network to collect hashes, names, and paths associated with every file on the multiple user devices; and a management console having one or more processors configured to: classify the multiple user devices in the network into multiple groups based on differences between the hashes, names, and paths associated with the files on the multiple user devices and hashes, names, and paths associated with every file on one or more reference systems; identify files uniquely associated with the multiple groups based on the differences between the hashes, names, and paths associated with the files on the multiple user devices and the hashes, names, and paths associated with the files on the one or more reference systems; and generate an alert if one or more of the multiple user devices that are classified in a first one of the multiple groups includes the files that are uniquely associated with another one of the multiple groups.