Where do a company's leaked credentials come from?
Not all leaks carry the same weight. Knowing where a credential comes from tells you whether it is old or recent, whether it is still valid and how urgently you need to act.
| Source | What it contains | Typical risk |
|---|---|---|
| Third-party breaches | The corporate email address and a password, in plain text or hashed, from an external service where the employee signed up | High if they reuse the password on company systems |
| Combolists | Lists of usernames and passwords compiled from many breaches and recycled over and over | Medium: lots of old data, but it fuels automated credential stuffing attacks |
| Infostealer logs | Passwords saved in the browser, session cookies, autofill data, machine details and login URLs | Very high: recent data, often valid, with sessions that can bypass MFA |
| Phishing | Credentials typed into a fake page, sometimes with the session cookie | Very high: the attacker usually uses them within minutes |
Why are infostealer logs the most serious case?
An infostealer is malware that, as soon as it runs, copies the passwords saved in the browser, session cookies and other data from the machine, and sends them to the attacker packaged in a log. These logs are sold on marketplaces and messaging channels, and other criminals buy them to break into accounts or resell access.
They spread through pirated software, malicious ads, fake CAPTCHAs and phishing emails. Microsoft identified more than 394,000 Windows computers infected by the Lumma infostealer worldwide between March 16 and May 16, 2025 alone.
Three reasons make them especially dangerous for a company:
- They often infect machines your EDR cannot see. According to the Verizon 2025 DBIR, 46% of the systems compromised by infostealers that held possible corporate credentials were unmanaged devices, such as personal computers someone uses to access email or the VPN.
- They include session cookies. With them, the attacker can get in without a password or MFA until the session expires or is revoked.
- They can precede bigger attacks. The same report found that 54% of a sample of victims published by ransomware groups had their domain in infostealer logs or in credential marketplace listings.
How can you tell if your company's credentials have been leaked?
- Search for your domains in breach notification services. Have I Been Pwned, for example, lets you verify ownership of a domain and see which addresses appear in known breaches. Its coverage focuses on breaches and datasets that have become public, not on everything that circulates in log marketplaces.
- Check whether your identity platform detects leaked credentials. Some include it depending on the license; check whether it is turned on and who receives the alert.
- Use threat intelligence that covers log marketplaces, messaging channels and forums. That is where recent logs show up, and accessing and analyzing them requires specialized sources.
- Look for signs in your own logs: valid sign-ins from unusual IPs or countries, the same session used from two locations at once, and mass sign-in attempts against the VPN or the access portal.
What should you do if your company's credentials show up?
The response depends on the type of finding. This table summarizes the usual actions:
| Finding | What to do |
|---|---|
| Corporate email in an old breach of an external service | Check whether the password is reused at the company, force a change if in doubt and remind staff that corporate email is not used for personal services |
| Username and password in a combolist | Change the password, review recent access attempts and confirm the account has MFA |
| Infostealer log with corporate credentials | From a clean machine, change every password in the log, revoke sessions, locate and rebuild the infected machine and review access since the infection date |
| Session cookies for corporate applications | Immediately revoke sessions in the identity provider and in the affected SaaS applications |
| VPN, remote access or service account credentials | Top priority: rotate them, review access logs and look for persistence |
In every case, follow this order:
- Validate the finding with your identity team: whether the account exists, whether it is still active and whether the date of the finding is later than the last password change. Do not test the leaked credential on your systems.
- Contain: change the password, revoke open sessions and review the registered MFA methods.
- Find the source. If it is an infostealer, the infected machine keeps stealing data. The log usually includes the machine name, Windows username, IP, malware path and infection date, and it may turn out to be a personal device.
- Investigate usage: review sign-ins since the date of the log or the breach.
- Fix the root cause: passwords saved in the browser, unmanaged devices with corporate access or accounts without MFA.
How do you monitor leaked credentials continuously?
A one-off check is a snapshot, and infostealer logs are published every day. Useful monitoring has these components:
- Source coverage: public breaches, combolists, infostealer log marketplaces and channels, and forums.
- Monitoring by domain and by person: your domains, those of your subsidiaries and the accounts of executives and administrators.
- Deduplication and freshness, to tell a new finding apart from data recycled years ago.
- Context to act on: which machine, which date, which applications and whether the account is still active.
- A link to response: the alert reaches whoever can change the password and revoke the session, and there is a record of what was done.
How can you reduce the impact of future credential leaks?
- Phishing-resistant MFA, such as FIDO2 keys or passkeys, on privileged accounts and remote access.
- Conditional access that requires a managed device for corporate applications. That way, a credential stolen from a personal computer loses much of its value.
- A corporate password manager instead of the browser.
- Shorter or device-bound sessions in critical applications.
- A clear rule: corporate email is not used to sign up for personal services.
- EDR on every machine that accesses company data.
How Ciberia CTM helps you monitor leaked credentials
Ciberia CTM continuously monitors your company's external exposure: leaked credentials, exposed infrastructure and mentions of your brand and your executives. Every alert comes with context and a recommended action. It draws on Ciberia Intel, which brings together proprietary and third-party intelligence on credentials and infostealers, the dark web and forums.
On the Ciberia platform, alerts follow the flow of context, decision (the AI proposes and an analyst validates decisions with impact) and orchestrated action. Every automatic action is logged: who, when, on what criteria and on what data.
