How to check if your company's logins have been leaked

Most companies find out their logins have leaked when someone uses one. An unusual sign-in, a mailbox rule nobody set up, a ransom note. By then the login has usually been for sale for weeks or months.

You can find out much earlier. The logins are sitting in stealer logs and breach dumps that anyone can buy, which means you can search them too. This guide covers where leaked company logins come from, how to check for them, and what to look at first when you find some.

Where leaked company logins come from

Company logins leak in three main ways, and each needs a different check.

Stealer logs. Malware on an infected computer copies every password saved in the browser, along with session cookies and details about the machine. If an employee ever saved a work login on that computer, it's in the log. This is now the most common source of working corporate logins, and the most urgent. If you're new to them, start with what stealer logs are and how they're traded.

Third-party data breaches. When a service your staff signed up for with their work email is breached, their email address and password for that service leak. If someone reused their work password there, the breach exposes your systems too.

Your own breaches. If your company's systems were breached, your customers' and staff's details may already be circulating, whether or not you know about it.

What to search for

A useful check covers more than your staff's email addresses. There are two kinds of exposure, and both matter.

Logins that use your email domain. Any leaked login where the username is @yourcompany.com. These show which employees have been infected or caught in breaches, and which other services they were using with their work email.

Logins to your own websites and apps. Any leaked login where the website is one of yours, such as your single sign-on page, VPN portal, admin panels, customer portal or webmail. These can belong to staff, contractors or customers using personal email addresses, so a search by email domain alone misses them.

The second kind is where the serious findings usually are. A contractor's personal Gmail logging into your VPN portal won't show up under your email domain, but it's exactly the access an attacker wants.

If you have more than one domain, check all of them, including older domains from acquisitions and rebrands that still have working accounts.

How to run the check

There are three ways to do this, depending on how deep you need to go.

1. Free breach lookup services

Services like Have I Been Pwned let you check email addresses, and domain owners can verify their domain to see which addresses appear in known breaches. It's a sensible first step and costs nothing.

The limit is coverage. Breach notification services focus on data breaches and mostly don't include stealer logs, which are where current, plain-text passwords and session cookies come from. They also tell you that an address was in a breach, not which password leaked.

2. Search criminal sources yourself

Some security teams buy logs or join criminal Telegram channels to search them directly. We wouldn't recommend it. You'd be paying criminals, handling stolen personal data, and taking on legal risk, and you'd still only see the small slice of logs you happened to collect.

3. Use a stealer-log monitoring service

A monitoring service collects logs and breach dumps continuously and lets you search them by domain, email address, username, password, IP address or website. A good one shows you the full record: which login leaked, the site it was for, when the machine was infected, and where the log came from. That's what lets you act on a finding rather than only know about it.

That's what we built BreachDetect for. It searches 44 billion stealer-log records and hundreds of breached databases, with new logs added daily. You can try it on your own domain without signing up to see how much is out there.

What to look at first

A first check on a company domain often returns hundreds or thousands of results. Most of them aren't emergencies. To find the ones that are, sort them like this:

1. Logins to your own systems. Single sign-on, VPN, remote desktop, webmail, admin panels and cloud consoles. These give direct access and come first, whoever they belong to.
2. Recent infections. A stealer log from last month is far more likely to contain a working password and a live session than one from three years ago.
3. Accounts that are still active. Check each hit against your directory. A login for someone who left in 2022 matters only if the account still works.
4. Reused passwords. If a staff member's leaked password for a third-party site matches the pattern of their work password, treat the work account as exposed.
5. Privileged accounts. Administrators, finance staff and anyone with access to production systems or customer data move up the list.

Everything else, such as old third-party breaches for people who've since changed their passwords, can be handled in bulk with a reminder about password reuse.

What to do with a finding

For any login that's current and gives access to your systems:

• Reset the password and revoke every active session and token. A password reset alone doesn't sign out an attacker who's using a stolen cookie.
• Check the account's recent sign-ins, MFA changes, mailbox rules and new devices for signs someone has already used it.
• If the login came from a stealer log, the person's computer is infected. Find out which machine it was and get it cleaned or rebuilt before they sign in again.

We've written a fuller playbook for this in what to do when employee credentials show up in a stealer log.

How often to check

Once isn't enough. New stealer logs are uploaded every day, and a domain that's clean today can have fresh results next week. Teams that take this seriously check their domains at least weekly, and check again whenever there's a reason to, such as a suspicious sign-in, a phishing campaign against staff, or a new contractor joining.

The goal is to make the gap between a login leaking and you resetting it shorter than the time it takes an attacker to find it and use it.