In this article
A data breach on another website only becomes your company's problem when the same password opens a work account. To prevent it, check your entire domain with a service such as Have I Been Pwned, change exposed passwords, enable MFA on every account and give the team a password manager. It is a matter of days, and it is one of the foundations of the managed cybersecurity that DataRoad - IT Services and Consulting applies for its clients.
How the team's emails end up in a breach
Employees use their work email to sign up for online tools, conferences, shops and training platforms. When one of those services is attacked, the list of emails and passwords is often published or sold. The company was not attacked, but the team's data is in there.
If the password for that site is the same as for Microsoft 365, the attacker already has the key. There is nothing to guess.
Credential stuffing, explained in two paragraphs
“Credential stuffing” means taking thousands of email/password pairs stolen from one site and testing them automatically on others. It works because, as OWASP — the international application security foundation — explains, many people reuse the same email and the same password.
Imagine someone who finds the key to your holiday home and tries it, just in case, in the office door. That is exactly it, but done by software, at a scale of thousands of attempts.
Three checks to carry out this week
Can each employee look up their own email?
Yes. At haveibeenpwned.com anyone can search for their address and see which known breaches it appears in. It is excellent for raising the team's awareness, but it does not give the company-wide picture.
How do you check the whole domain?
To list every @yourcompany.com address, Have I Been Pwned requires proof that you control the domain, by one of four methods:
- DNS — a TXT record with the value provided.
- Meta tag — a tag on the website's home page.
- File — a small HTML file uploaded to the server.
- Email — a link sent to an administrative address on the domain.
Whoever manages the DNS or the website can do this in minutes. According to the service's pricing page, monitoring carries no cost for domains with up to 10 exposed addresses; beyond that a paid subscription is required, with tiers based on the number of addresses.
And the passwords themselves?
The same service maintains Pwned Passwords, a database of passwords already seen in breaches, which can be queried without revealing the password to whoever checks it. NIST, the US standards institute, recommends precisely this: comparing every new password against lists of common or compromised passwords and rejecting it if it appears there. In Microsoft environments there are equivalent protections that block weak or known passwords.
A four-step response plan
| Step | Action | When |
|---|---|---|
| 1. Triage | List exposed addresses, the breaches they appear in and their dates | Day 1 |
| 2. Change | Change the affected passwords — administrators, finance and management first — and end open sessions | Days 1 to 3 |
| 3. MFA | MFA on every account, without exception, and blocking of legacy protocols that do not support it | Week 1 |
| 4. Password manager | A company password manager for every employee, to put an end to reuse | Month 1 |
- Change with judgement NIST no longer recommends mandatory changes every 90 days. Current guidance is to force a change only when there is evidence of compromise, and appearing in a breach is exactly that evidence.
- MFA at the centre With MFA, a stolen password is no longer enough; approval on the phone is still missing. According to Microsoft, MFA combined with blocking legacy authentication stops more than 99.9% of common account attacks. Options in multi-factor authentication in the company.
- An end to reuse Nobody memorises 40 long, different passwords. The manager generates, stores and fills them in. NIST asks systems to accept these managers and password pasting, with a minimum of 15 characters when the password is the only factor. How to choose: password managers for businesses.
DataRoad IT Unlimited
Talk to DataRoad. We assess your operation and propose the right plan.
When the account has already been used: warning signs
Being in a breach does not prove that someone has logged in. These signs, however, call for immediate action:
- Unusual sign-ins Logins from countries where the company does not operate.
- New email rules Messages forwarded externally or deleted.
- Unrequested MFA prompts Which the employee may approve by mistake.
- Odd emails to clients or suppliers For example, with a changed IBAN; see the altered invoice scam.
These signs only reach someone in time if there is monitoring with alerts. In DataRoad's IT Unlimited plans, that monitoring is part of the included security, alongside MFA and endpoint protection.
Ventask: 350 workstations with managed security since 2016
Ventask has worked with DataRoad since 2016 and today has 350 workstations under IT Unlimited, with managed firewalls, endpoint security, remote working solutions and maintenance of its cybersecurity solutions. At this scale, the question is not whether an email will appear in a breach, but how quickly an exposed account stops being an open door.
Read the Ventask case: 350 workstations and managed firewalls and discover our managed cybersecurity for businesses.
Frequently asked questions
Can I legally check my company's emails?
Yes, on your own domain — hence the proof of control required by Have I Been Pwned. The aim is to protect company accounts, not to look into employees' personal lives.
Does an email in a breach mean the account has been hacked?
Not necessarily. It means the email, and sometimes a password, was exposed on another service. The risk depends on whether that password is still used at work and whether the account has MFA.
Is it worth forcing monthly changes?
No. NIST recommends changing only when there are signs of compromise. Long, unique passwords, kept in a manager and protected by MFA, are more effective.
How often should we check?
Ideally, continuous monitoring, with an alert for every new breach that includes company addresses. At a minimum, one check per quarter and another whenever a breach is reported at a service the team uses.
Next step: exposed credentials check in 5 working days
We analyse your domain against known breaches, identify the accounts at risk, confirm MFA on all of them and hand over a ready-to-use plan for password changes and a password manager. No-commitment proposal. More than 10 workstations · support contract · remote, on-site and telephone support.
Sources
- Have I Been Pwned — How do I verify my domain?
- Have I Been Pwned — Pricing (no cost for up to 10 exposed addresses)
- Have I Been Pwned — FAQs (Domain Search and Pwned Passwords)
- NIST SP 800-63B-4 — Authentication and Authenticator Management
- OWASP — Credential stuffing
- Microsoft Learn — Security defaults in Microsoft Entra ID
