Breach Response Playbook: What to Do When Credentials Are Found

Overview

Discovering that your organization's credentials are exposed in stealer logs or breach databases requires a structured, time-sensitive response. This playbook provides a four-phase framework adapted from industry incident response standards.

---

Phase 1: Immediate Response (First 2 Hours)

Goal: Stop the bleeding — prevent unauthorized access using the compromised credentials.

Actions:

1. Identify affected accounts

   • Review the exposure report to list all compromised email addresses
   • Cross-reference with your identity provider (Active Directory, Okta, Google Workspace)
   • Prioritize by access level: admin accounts first, then VPN/remote access, then email, then SaaS

2. Force immediate password resets

   • Reset passwords for all identified accounts — do not wait for users to self-service
   • Generate strong, unique passwords for each account
   • Do not reuse any previously exposed passwords

3. Revoke active sessions

   • Force logout on all active sessions for compromised accounts
   • Revoke OAuth tokens and app passwords
   • Invalidate any API keys associated with compromised accounts

4. Enable or enforce MFA

   • If MFA is not enabled on compromised accounts, enable it immediately
   • Prefer hardware security keys or authenticator apps over SMS

---

Phase 2: Investigation (First 24 Hours)

Goal: Determine the scope of the breach and whether unauthorized access occurred.

Actions:

1. Review access logs

   • Check login history for each compromised account over the past 30–90 days
   • Look for logins from unfamiliar IP addresses or geographic locations
   • Check for unusual access patterns (off-hours activity, bulk data downloads)

2. Determine the source

   • Stealer log entry → indicates malware on a device. Identify the infected endpoint.
   • Breach database entry → indicates a third-party service was breached. Identify which service.
   • Combo list → aggregated from multiple sources. May be historical.

3. Assess data exposure

   • Did attackers access sensitive data, customer information, or financial records?
   • Were any email forwarding rules or OAuth grants added by attackers?
   • Were any new admin accounts or API keys created?

4. Document findings

   • Record timeline, affected accounts, accessed systems, and any evidence of unauthorized activity
   • This documentation is critical for compliance reporting (GDPR, HIPAA, SOC 2)

---

Phase 3: Containment & Remediation (First 7 Days)

Goal: Close the vulnerabilities that led to the exposure and prevent recurrence.

Actions:

1. Enforce MFA organization-wide

   • Deploy MFA on all corporate services, not just compromised accounts
   • Consider conditional access policies (e.g., require MFA from new devices/locations)

2. Scan for malware

   • If stealer logs are the source, run full endpoint scans on the likely infected devices
   • Consider deploying EDR/XDR if not already in place
   • Check for persistence mechanisms (scheduled tasks, startup items, browser extensions)

3. Audit credential reuse

   • Check if exposed passwords were reused across other services
   • Implement a password manager to prevent future reuse

4. Review and strengthen policies

   • Update password policies to require stronger passwords
   • Implement password breach checking (e.g., check against known breached password lists)
   • Review acceptable use policies for personal devices

5. Notify affected parties (if required)

   • Under GDPR, significant personal data breaches must be reported within 72 hours
   • Under HIPAA, breaches affecting 500+ individuals require HHS notification
   • Consult your legal team for jurisdiction-specific requirements

---

Phase 4: Prevention & Monitoring (Ongoing)

Goal: Build resilience against future credential exposure.

Actions:

1. Deploy continuous credential monitoring

   • Verusight Pro Guard monitors your domains every 30 minutes and alerts on new exposures

2. Implement security awareness training

   • Educate employees about the risks of:
     • Saving corporate passwords in personal browsers
     • Downloading unverified software
     • Using work credentials on personal accounts
     • Clicking links in unsolicited emails

3. Strengthen endpoint security

   • Deploy EDR/XDR on all corporate and BYOD devices
   • Enforce browser security policies to limit credential storage
   • Consider privileged access management (PAM) for admin accounts

4. Regular security assessments

   • Schedule quarterly credential exposure scans
   • Conduct periodic penetration tests
   • Review and update incident response procedures annually

---

Response Timeline Summary

Phase	Timeframe	Key Action
Immediate	0–2 hours	Force password resets, revoke sessions, enable MFA
Investigation	2–24 hours	Check access logs, determine source, document
Containment	1–7 days	Enforce MFA, scan for malware, audit credential reuse
Prevention	Ongoing	Continuous monitoring, training, endpoint security

Related Articles

• What Are Stealer Logs?
• How Continuous Monitoring Works
• Risk Severity Scores