·
3 min read
How to check whether your company's emails are in a breach
Free ways to check whether company email addresses appear in known breaches, what the results don't tell you, and when to move to monitoring.
Nikita Varabei
To check whether your company’s email addresses appear in known breaches, start with Have I Been Pwned, which lets a verified domain owner search every address on the domain. It’s free for domains with up to 10 breached addresses, and larger domains need a paid subscription. Browser and password-manager breach checks cover individual saved passwords. These tell you an address was in a breach. They don’t show the leaked password or grade how urgent it is. That’s where monitoring comes in.
Free checks
Have I Been Pwned (domain search) What it does: Lists every address on a verified domain found in known breaches, with the breach name. Limits: Shows that a breach happened, not the leaked value or whether it’s still usable. Free up to 10 breached addresses.
Browser and password manager checks What it does: Flags saved passwords that appear in breach lists. Limits: Only covers passwords saved in that tool, per person.
Google and Apple account checks What it does: Warns users about compromised saved passwords. Limits: Personal, not company-wide.
What the results don’t tell you
Whether the password was plaintext or hashed, and whether it’s recent.
Whether the same password is reused on your official accounts.
Which findings to work first.
Running a one-time check well
Verify your domain with the breach-check service, then export the results.
Sort by breach date and treat recent breaches as urgent.
Cross-check affected people against who holds access to official accounts.
Reset and end sessions for anyone in a recent breach. See what to do when employee credentials appear in a breach.
When to move to monitoring
A one-time check is a snapshot. If your team holds official accounts that can speak for the company, or your customers move money through you, you want to know about the next leak without someone remembering to search. Monitoring checks your domains daily, grades findings so the plaintext and recent ones come first, and alerts your team in Slack. See how ChainPatrol’s dark web monitoring works.
Frequently asked questions
Is Have I Been Pwned safe to use for company addresses?
Yes. It’s widely used and free for smaller domains. Domain search requires proving you control the domain.
Why do breach checks miss things?
They only know about breaches that have been collected and loaded. New dumps and private leaks appear elsewhere first.
What’s the difference between a breach check and dark web monitoring?
A check is a one-time search you run. Monitoring runs continuously against your targets, grades what it finds and alerts you. See what dark web monitoring is, and what it isn’t.
Want the graded version for your domains? Get a free scan, with results within 48 hours.
Sources
Accessed October 2026. Check each source for the latest.
Fakes of your brand already out there?
ChainPatrol finds them, blocks the links in wallets and browsers, and files the takedowns for you.
More from The Impersonation Institute
What dark web monitoring is, and what it isn't
Dark web monitoring finds leaked data about your organization in breach datasets and leak sites. What it covers, what it doesn't, and how it differs.
Nikita Varabei
Dark web monitoring
What to do when employee credentials appear in a breach
A response checklist for when staff passwords show up in a breach. Reset, revoke, check reuse, watch for impersonation, and tell the right people.
Nikita Varabei
Dark web monitoring
How leaked credentials become brand impersonation
The chain from a staff password in a breach to a hijacked official account, a fake announcement or a cloned help center, and where to break it.
Nikita Varabei
Dark web monitoring