Log in Request a demo

How To Defend

How To Respond To Leaked Credentials.

A leaked credentials alert means a working login for your staff or customers has appeared in a dark web dump, stealer log or combo list. Attackers feed these pairs into credential stuffing, then take over accounts. First confirm which account the pair opens, then reset the password, end all active sessions and check recent sign-ins before you do anything else.

  • Identity
  • Raised by DarkWeb Monitoring
Alert area
Identity
Raised by
DarkWeb Monitoring
First 24 hours
7 steps
Investigation
8 checks
Who acts
SOC analyst, IT admin, Legal and 1 more
Last updated October 9, 2026

What This Alert Means.

A leaked credentials alert means a working username and password pair for your staff or customers has shown up outside your control. It may sit in a dark web dump, a stealer log or a combo list. A combo list is a big file of email and password pairs that criminals trade and feed into automated login tools. Treat the pair as usable until you prove otherwise.

Attackers use these pairs for credential stuffing: they try the same email and password on many sites, hoping people reused them. A success becomes an account takeover, where someone else controls a real account. The first job is to find out which account the pair opens and cut off access to it.

First 24 Hours.

Work in this order. Each step names who does it.

Do now
  1. SOC analyst Open the alert from the Brandefense dark web monitoring module and record the exact email, source and dateSave a copy of the evidence before anything else changes
  2. SOC analyst Decide if the account is an employee, a customer or a service accountThe next steps differ for each
  3. IT admin Force a password reset and end all active sessions for the accountA reset alone may leave stolen sessions alive
  4. IT admin Check that MFA (a second proof of identity at login) is on, and review recent sign-insLook for new devices, new countries and mail forwarding rules
  5. SOC analyst Search sign-in logs for the same email across your apps, not only the one in the alertReused passwords mean one leak can open several doors
  6. Legal Ask whether the leak triggers any notification dutyCheck with your legal counsel before you contact anyone outside the company
  7. Customer support For customer accounts, prepare a plain notice and a reset pathDo not ask customers for their old password

Investigation Checklist.

Use this list to decide how far the damage goes. Tick each item and keep notes.

Confirm scope
  • Does the leaked password still match the live account? Test only through your own reset tools, never by logging in as the userDo not log in with the leaked password yourself
  • Is the email on your domain, or a personal address used for work?Personal addresses need a conversation with the person
  • Where did the leak come from: a breach of a third party, a stealer log or a combo list?A stealer log means the device may be infected, so also read our infostealer playbook
  • Are there failed or successful logins from unfamiliar IP addresses, many accounts from one address, or bursts of failures?This pattern is typical of credential stuffing
  • Were any MFA prompts approved that the user did not start?Repeated prompts can signal an attacker with the password
  • Were mailbox rules, forwarding, API tokens or app passwords added?Attackers keep access this way after a reset
  • Did the account touch payment, admin or customer data after the leak date?This sets the severity
  • Does the user reuse the password elsewhere?Ask them to change it on every other site

Containment And Removal.

You cannot delete data from a criminal forum, so containment means making the leaked pair useless. NIST says a verifier must force a password change when there is evidence that the authenticator has been compromised. Then use the paths below to reduce further spread.

  • Your own systems: reset the password, revoke sessions, tokens and app passwords, and remove any rules the attacker added.
  • Third-party services: if the pair opens a SaaS tool, ask the vendor to terminate sessions on their side.
  • Paste or hosting sites: if the dump sits on a public site, send an abuse report to the hosting provider or the site operator's abuse contact, naming the exact URL.
  • Customers: lock the affected accounts and send them a reset link through a channel you already trust.
  • Law enforcement or national CERT: for large leaks or active fraud, report to your national CERT. In Turkiye that is USOM (usom.gov.tr), which says its services, including incident reports, now continue on the Cyber Security Directorate site (siberguvenlik.gov.tr). In the US, file with the FBI IC3.

WarningDo not wait for the user to notice. If the password was reused on any system that holds sensitive data, reset it there too and check the logs first.

  1. Confirm the accountMatch the leaked email to a real account
  2. Cut accessReset the password and revoke sessions
  3. Check for persistenceRules, tokens, new MFA devices
  4. NotifyUsers and, after legal review, others

Longer-Term Hardening.

Credential stuffing works because passwords get reused. Fix the process, not only the single account.

  • Turn on MFA everywhere. OWASP calls MFA by far the best defense against credential stuffing. CISA says FIDO/WebAuthn is the only widely available phishing-resistant MFA, and that any MFA is better than none.
  • Block known-bad passwords. NIST says a password must be compared against a blocklist of commonly used and compromised passwords, including those from earlier breaches.
  • Limit failed logins. NIST says verifiers must limit consecutive failed attempts on a single account. Add device checks and bot challenges for suspicious logins, as OWASP suggests.
  • Tell users about odd activity. OWASP recommends telling the user when a login with the correct password then fails the MFA check, and letting users see and end their own sessions.
  • Stop forced rotation. NIST says not to make people change passwords on a schedule, only after evidence of compromise.
  • Give staff a password manager so unique passwords are practical.

How To Measure That It Worked.

Pick measures you can read from your own logs and compare month to month.

  • Share of leaked accounts with a reset and session revoke recorded.
  • Number of accounts with MFA, split by staff and customers.
  • Failed login rate and the number of accounts hit from one source address.
  • Repeat alerts for the same account after reset. A repeat means the cause was not fixed.
  • Count of accounts blocked at signup or reset because the password was on a breached list.
  • Account takeover reports from customers, tracked over time.

Common Mistakes.

These errors let the same leak hurt you twice.

  • Resetting the password but leaving old sessions, tokens and mail rules in place.
  • Checking only the one app named in the alert, not every place the email is used.
  • Testing the leaked password by logging in as the user.
  • Treating a stealer log as a simple password leak. MITRE notes stolen session cookies can bypass some MFA.
  • Sending customers a notice that legal never reviewed.
  • Making users change passwords every few weeks, which leads to weak, similar passwords.
  • Closing the alert once the password changes, without watching the account for new logins.

Questions.

  • What should I do first when employee credentials are leaked?

    Find the account the leaked pair opens, then reset the password and end all active sessions. Check recent sign-ins for new devices and countries, and look for mail forwarding rules or new tokens. Keep a copy of the alert evidence before you change anything.

  • What is credential stuffing?

    Credential stuffing is when attackers try email and password pairs from past leaks on many other sites. It works because people reuse passwords. OWASP calls multi-factor authentication by far the best defense, and also suggests checking new passwords against breached password lists.

  • Is resetting the password enough after a leak?

    Not always. A reset does not end sessions, tokens or app passwords an attacker may already hold, and it does not remove mailbox rules. Revoke sessions, review MFA devices and check for added rules. If the source was a stealer log, the device may need cleaning too.

  • How do I tell if an account was taken over?

    Look for sign-ins from unfamiliar addresses or places, MFA prompts the user did not start, new mailbox rules, new MFA devices and unusual activity after the leak date. Many failed logins across several accounts from one source also points to credential stuffing.

  • Should I make users change passwords regularly?

    NIST says not to require periodic password changes, but to force a change when there is evidence the password has been compromised. A leak alert is that evidence. Pair this with a blocklist of known compromised passwords and MFA.

Sources

  1. 1 OWASP Credential Stuffing Prevention Cheat Sheet
  2. 2 NIST SP 800-63B Digital Identity Guidelines
  3. 3 CISA: More than a password (MFA)
  4. 4 MITRE ATT&CK T1539 Steal Web Session Cookie
  5. 5 USOM National Cyber Incident Response Center
  6. 6 FBI IC3 PSA on business email compromise

This page is general security guidance. It is not legal advice. Notification duties and takedown rights depend on your country, your contracts and the facts of the case, so ask your legal counsel before you act on them.

More Playbooks.

All Playbooks
Identity Deepfake and voice-clone fraud A deepfake alert means someone may be using an AI-made voice, photo or video of a senior person to trick staff, partners or customers. Treat the request as unverified until you confirm it with the real person on a channel you already trust. Pause any payment, access or data request tied to that person, and save the evidence before anything is deleted. Open Identity Executive impersonation An executive impersonation alert means someone has built a fake profile or account that uses a senior person's name, photo or role. Criminals use these to trick staff, partners or customers into paying or sharing data. First confirm with the executive through a known channel, then save evidence and warn finance. Open Identity Infostealer log exposure A stealer log alert means malware on a device may have copied saved passwords and browser cookies for your staff or customers. Cookies can let an attacker act as a signed-in user, even with MFA on. First isolate the likely infected device, then end all sessions and reset passwords from a clean device. Open

Keep Exploring.

Knowledge Hub
Glossary term Leaked Credentials Leaked credentials are usernames, passwords or other login details that have become exposed outside the control of their owner. Open Glossary term Stealer Logs Stealer logs are bundles of data collected from an infected device by information-stealing malware. Open Article What Is Credential Stuffing? Attackers Don’t Crack Passwords, They Buy Them Credential stuffing explained: how attackers test real stolen username and password pairs across services, where the lists come from, and how to detect it. Open Article What Is Incident Response And How To Build It? Learn what incident response is, its six stages from preparation to lessons learned, the tools teams use, and how to build a plan for… Open

Browse The Library.