Why one plaintext password matters more than a thousand old hashes

Dark web monitoring vendors like big numbers. Billions of records, millions of new credentials a week. For a security team the number that matters is much smaller. How many of our people have a password, in plaintext, exposed recently enough that someone can type it in today? That’s usually a handful, and those are the ones worth your afternoon.

Why old hashes mostly don’t matter

A hashed password from a breach years ago is a weak signal. The hash may never be cracked, the password has probably been changed, and the account may not exist. Treating it like an emergency trains teams to ignore alerts. Treating every record the same is how monitoring becomes noise.

Why plaintext this year does

A plaintext password exposed in the last 12 months is a different animal. It can be tried against your official social accounts, admin consoles and email in minutes. If the person reused it, which many people do, it works. And if the account it opens can speak for your company, the result is impersonation with the credibility of the real account behind it.

How we grade

ChainPatrol marks a finding Critical when it’s a plaintext password exposed in the last 12 months. High covers older plaintext passwords and exposed payment cards. Medium and Low cover hashed passwords and records without one. Domain findings can be grouped by person, so a single employee who appears in five breaches is one problem to solve, not five alerts to triage. Sensitive values are masked in the app, and alerts go to Slack.

What to ask any vendor

• How do you grade findings, and what does your top grade mean?

• Can I see findings by person, not only by record?

• Do you show the breach source and date?

• What does the alert tell my team to do next?

Fewer, clearer findings beat a bigger database. See how ChainPatrol’s dark web monitoring works.

See your critical findings, not your record count. Get a free scan, with results within 48 hours.