How do we find out if our credentials are already out there?

When a service your staff used gets breached, the email and password combinations end up circulating. If somebody used their work email to sign up for something years ago, and reused that password, it is potentially in a list being traded right now.

We monitor client domains for credentials appearing in breach data and tell you what turned up, which account, and roughly where it came from. This is the thing usually marketed as dark web monitoring, which oversells it slightly: most of this data is traded in places that are not especially hidden. The name is dramatic, the service is genuinely useful, and it is one of the highest value low cost things you can have running.

What to do when something appears, which it usually does:

• Change that password everywhere it was used, which is the part people underestimate
• Confirm multi factor authentication is on for that account
• Check the account for signs of access: mailbox rules, forwarding, unfamiliar sign-ins

The finding people dislike most is a breach from a personal service a staff member signed up for with their work address. That is not a telling-off, it is exactly why monitoring exists, and it is the most common way a business email compromise starts.