What to do when employee credentials appear in a breach

When an employee’s credentials appear in a breach, reset the password, end active sessions, and check whether the same password was reused on other systems. Then look outward, because stolen staff logins are often used to impersonate the company, and tell the people who need to know. Work the plaintext, recent findings first.

1. Triage by severity

Not every finding is urgent. A plaintext password exposed this year can be used today. A hashed password from an old breach usually can’t, unless it’s weak or reused. Sort findings into those two groups before anyone starts resetting.

2. Contain the account

• Reset the password and require a new one that hasn’t been used elsewhere.

• End every active session, including mobile and API tokens, so a stolen session can’t outlive the reset.

• Confirm multi-factor authentication is on, and check that recovery options haven’t been changed.

• Review recent sign-in activity for the account.

3. Check for reuse

People reuse passwords. If the leaked password matched the work account, assume it was used elsewhere too, especially on tools that hold your official channels: social media accounts, admin consoles, email marketing and support platforms. Rotate those first.

4. Look outward for impersonation

Stolen staff credentials are a common first step in brand impersonation. Watch your official accounts for posts you didn’t make, your help center and admin tools for changes, and search for fake profiles using the affected employee’s name. See how leaked credentials become brand impersonation and how to remove fake executive profiles.

5. Tell the right people

• The employee, with plain instructions and no blame.

• Your security or IT lead, with the finding, its source and what’s been done.

• Legal or compliance, if the leak included personal data that triggers notification duties where you operate.

• Finance or fraud, if the person approves payments or has access to customer funds.

6. Close the loop

• Record what was found, what was done and when.

• Mark the finding acknowledged in your monitoring tool so it doesn’t resurface as new.

• If the same person appears in several breaches, add them to individual tracking and consider a hardware security key.

Frequently asked questions

Should we force a company-wide reset after one leaked password?

Not usually. Reset the affected accounts and any reuse you find. A company-wide reset is for a confirmed compromise of your own systems.

Do we need to notify customers?

Only if customer data was involved, which depends on the breach and your legal duties. Ask counsel.

How do we know when new leaks appear?

Continuous monitoring of your email domains, with alerts, replaces manual checks. See how ChainPatrol’s dark web monitoring works.

Find out which of your staff credentials are already exposed. Get a free scan, with results within 48 hours.