How to check if your company credentials leaked

To check whether your company credentials leaked, search your corporate domains and staff email addresses against known breach datasets and infostealer logs, then rotate any password that comes back and turn on multi-factor authentication. Free tools such as Have I Been Pwned cover public breaches in a few minutes. The credentials that never surface in those public dumps, the ones stolen quietly by malware on an employee laptop, are the ones that need continuous monitoring to catch.

That is the whole answer. The rest of this guide explains where leaked credentials come from, how to run the checks without exposing anything in the process, and what to do the moment a real hit turns up.

Where leaked company credentials come from

“Leaked” covers three different origins, and the check for each is slightly different.

The first is the classic data breach: a service your staff used gets compromised, and its user table (emails plus password hashes, sometimes plaintext) ends up traded or dumped publicly. If an employee reused their work password on that service, the breach is now a company problem.

The second is the infostealer log. Malware on a personal or work device quietly harvests every saved browser credential, session cookie, and autofill entry, then ships them to an operator who bundles and sells them. These logs rarely make headlines, which is exactly what makes them dangerous: the credentials are current, tied to real active sessions, and often include corporate logins captured from a device that also holds personal accounts.

The third is not a leak at all but its consequence: credential stuffing, where attackers replay username and password pairs from one breach against your login pages, betting on reuse. The 2025 Verizon DBIR research found the median daily share of credential stuffing reached 19% of all authentication attempts, and that the use of compromised credentials was the initial access vector in 22% of the breaches it reviewed. Reuse is what turns one leaked password into many.

How to check right now, for free

You can get a first read in under an hour without buying anything. Work through it in order.

Search public breach data by domain

Start with Have I Been Pwned, the reference index of publicly known breaches. Its dataset currently spans more than 17.6 billion accounts drawn from over 1,000 breached sites, and its domain search lets you see every breached address under a domain you control, once you verify ownership of that domain. Verify your primary corporate domains and read the list of breaches each address appears in. A hit tells you an account existed in a breach; it does not tell you the password is still valid, which is why the next two steps matter.

Check passwords without ever sending them

A reasonable worry is that testing a password against a breach service means handing that password over. The well-designed tools avoid this. Have I Been Pwned’s Pwned Passwords uses a k-anonymity range search: your client hashes the password with SHA-1 locally and sends only the first five characters of that hash. The service returns every matching suffix, and the final comparison happens on your side, so the password itself never leaves the machine. Use this pattern to test whether any password in use appears in a known corpus, and reject the ones that do.

Look for infostealer exposure, not just breaches

Domain search finds breach dumps. It does not, on its own, surface infostealer logs, which is where a large share of fresh corporate credentials now circulate. Checking for these means looking at stealer log collections and criminal marketplaces for your domains and, ideally, for exposed session tokens. This is the part most teams cannot do by hand, and it is the reason a one-time public search is a starting point rather than a conclusion.

Why one leaked password rarely stays contained

The reason a single leak deserves attention is password reuse. The same Verizon research found that in the median case, only 49% of a user’s passwords across different services were distinct from one another. Read the other way: about half of a typical person’s passwords are shared with at least one other account. So a password stolen from a low-stakes forum has a real chance of unlocking the corporate mailbox, the VPN, or the admin console, which is the whole mechanism behind credential stuffing.

This is why the count of exposed accounts is the wrong thing to fixate on and the pattern is the right thing. A breach that exposes an employee’s personal login matters to you only if that person reused the password at work. You cannot see reuse from the outside, so the safe assumption is that any exposed credential belonging to a staff member is a lead worth rotating.

What to do when a credential turns up

A hit is not an emergency by itself, but it does start a clock. Work through four moves.

Rotate the affected credential first, before investigating further. If the password is exposed, its continued validity is the risk, and rotation closes it immediately. Do this even if you are not yet sure the account was abused.

Turn on multi-factor authentication everywhere it is not already required, starting with email, VPN, and any admin or single-sign-on account. MFA does not make a leaked password harmless, but it removes the attacker’s ability to log in with the password alone, which is the exact scenario credential stuffing depends on.

Block reuse of known-bad passwords at the point of entry. NIST SP 800-63B states that verifiers SHALL compare prospective passwords against a blocklist that includes values from previous breach corpuses, and reject any match with a reason given. Building that check into your password change flow stops the leaked password from simply being set again.

Look for use, not just exposure. Once a credential is rotated, check authentication logs for that account around and after the leak date for logins from unfamiliar locations or devices. Exposure is a warning; a successful sign-in is an incident, and the two get handled very differently.

One-time check versus continuous monitoring

A manual search answers “were we in a known breach as of today.” It goes stale the next morning, because new breaches and fresh stealer logs appear constantly and the public indexes catch up on their own schedule. For a domain you actually care about, the useful posture is standing coverage: continuous dark web monitoring that watches breach dumps and infostealer marketplaces for your domains and surfaces new exposures as they land, so rotation happens in days rather than whenever someone next runs a manual check.

The choice is not one or the other. Run the free public check this week to establish a baseline, fix what it finds, then decide whether the ongoing risk justifies continuous coverage. For most teams holding customer data or regulated systems, it does.

Quick answers

How do I check if my company email was in a breach? Use a domain search on a reputable breach index such as Have I Been Pwned after verifying you control the domain. It returns every address under your domain that appears in its dataset, along with which breaches each one was part of.

Is it safe to type a password into a breach checker? With a well-designed tool, yes. The k-anonymity approach hashes the password on your device and sends only the first five characters of the hash, so the password never leaves your machine. Avoid any checker that asks you to submit the full password in plain text.

What is an infostealer log and why does it matter more than a breach? It is a batch of credentials, cookies, and session tokens harvested by malware directly from an infected device. It matters because the data is current and often includes live corporate logins, and because these logs rarely appear in the public breach indexes that most manual checks rely on.

Does finding a leaked credential mean we were hacked? No. Exposure means a credential is circulating, not that anyone used it against you. Rotate it, enable MFA, and check the account’s sign-in history. A login from an unexpected place is what turns an exposure into an incident.

How often should we check for leaked credentials? A single check reflects only what is public today. Because new breaches and stealer logs surface continuously, ongoing monitoring is the only way to catch fresh exposures close to when they happen rather than months later.