The Call You Don't Want to Get
You've just been notified that employee credentials associated with your corporate domain have been found in a stealer log or breach database. The clock is ticking. Here's exactly what to do — step by step.
Phase 1: Immediate Response (First 2 Hours)
Identify the Scope
Start by understanding what you're dealing with:
- How many credentials are exposed?
- Which employees are affected?
- What services do the leaked passwords grant access to?
- How fresh is the data? Recent stealer logs are higher priority than years-old breaches
Force Password Resets
For all affected accounts, immediately force a password reset. Don't notify users first and wait — reset now, explain later.
Priority order:
- Admin and privileged accounts — These have the highest blast radius
- VPN and remote access — Direct entry to your network
- Email accounts — Gateway to password resets on other services
- SaaS platforms — Customer data and internal tools
Revoke Active Sessions
A password reset alone isn't enough if the attacker is already logged in. Revoke all active sessions for affected accounts across all platforms.
Phase 2: Investigation (Hours 2-24)
Check for Unauthorized Access
Review logs for the affected accounts:
- Login history — Any successful logins from unfamiliar IPs or devices?
- Email forwarding rules — Attackers often set up silent forwarding to maintain access
- OAuth application grants — Check for unauthorized third-party app connections
- Data access logs — Was any sensitive data downloaded or exported?
Determine the Source
Understanding how credentials were stolen helps prevent recurrence:
- Stealer log — Malware on the employee's device (personal or corporate)
- Third-party breach — A service the employee used was compromised
- Phishing — The employee entered credentials on a fake login page
Document Everything
Maintain a timeline of discovery, actions taken, and findings. This documentation is critical for compliance reporting and post-incident review.
Phase 3: Containment (Days 1-7)
Enable or Enforce MFA
If MFA isn't already mandatory, implement it immediately for all affected systems. Hardware security keys or authenticator apps are strongly preferred over SMS-based MFA.
Scan for Malware
If the source is a stealer log, the employee's device may still be infected:
- Run endpoint detection scans on corporate devices
- Advise affected employees to scan personal devices
- Consider re-imaging corporate devices for high-privilege users
Audit Credential Reuse
Check whether affected passwords were reused across multiple services. Credential reuse is the primary amplification factor in password breaches.
Phase 4: Prevention (Ongoing)
Deploy Continuous Monitoring
One-time responses address today's leak. Continuous credential monitoring ensures you're alerted in near real-time when new exposures occur.
Implement a Password Policy
- Require unique passwords for every service
- Mandate password manager usage
- Set minimum complexity requirements
- Schedule regular rotation for privileged accounts
Train Your Team
Regular security awareness training should cover:
- The risks of saving corporate passwords in personal browsers
- How to recognize phishing attempts
- Why password reuse is dangerous
- How to report suspected compromises
The Bottom Line
Credential leaks are not a matter of if but when. The organizations that suffer the least damage are the ones that detect exposures early and respond decisively.
The average dwell time for credential-based attacks is 287 days. With continuous monitoring, you can reduce that window to hours.