A breach rarely ends where it happened. Databases are sold, merged and sold again. A password that leaked from a small forum years ago is tried against corporate mail today, by a script, thousands of times an hour.
How a leaked password is used
Credential stuffing. The attacker takes pairs of e-mail and password from a breach and tries them on other services. No hacking is involved: the login form does exactly what it was built for.
Guessing the pattern. If the leaked password was Summer2024, the next attempts are Summer2025 and Summer2025!. People change a password the way they change a calendar.
Targeted phishing. A breach also contains names, phone numbers and addresses. A letter that mentions your real order number is opened far more often.
Account takeover. Once inside a mailbox, the attacker sets a forwarding rule and waits. Invoices with changed bank details are sent from a real account to real partners.
Why changing it in one place is not enough
The leaked service is the smallest part of the problem. The risk sits in every other place where the same password, or its close relative, is still in use. Until those are changed, the breach is still open.
What a person should do
- Change the password everywhere it was reused, starting with mail. Mail resets all the others.
- Use a password manager and a different password for every service.
- Turn on two-factor authentication. An app or a hardware key is stronger than SMS.
- Look through active sessions and mail forwarding rules. Remove what you do not recognise.
What a company should do
| Step | Effect |
|---|---|
| Check the corporate domain in breach data | You learn which accounts are exposed |
| Force a reset for those accounts | The leaked password stops working |
| Two-factor authentication on every external entry | A password alone is no longer enough |
| Reject known leaked passwords when a password is set | The same password cannot come back |
| Alert on logins from unusual places | Takeover is seen in hours, not months |
A well-built check never receives your password. The value is hashed in your browser, and only the hash is compared. If a service asks you to type a password and sends it as plain text, close the page.
Check once, then keep watching
A single check shows the past. New breaches appear every week, so the useful state is monitoring: the domain is checked continuously and you hear about a new exposure before the attacker uses it.
Data Breach Check is free for a person and for a domain. For a company, continuous monitoring is part of the Threat Intelligence subscription.
