Exposure intelligence
A leaked password can be the start of the next attack
Attackers can replay leaked credentials against other services. Understand that chain, review your account habits, and learn how to respond to a confirmed leak.
- Based on HIBP, Verizon, IBM & Cybernews data
- Primary sources linked
- Updated 2026
What is a data breach
A breach isn’t always a “hack”. Often it’s just a reused password.
A data breach is any incident where data is accessed or disclosed without authorisation – and leaked login credentials are one important type of exposure.
A data breach is the unauthorised access, disclosure or loss of data. It can be a sophisticated intrusion – but very often it’s a misconfigured database, a phishing victim, or a third-party service that gets compromised and dumps its user table online.
A particularly actionable type of exposed data is credentials: email-and-password pairs. Because people reuse passwords, one leak from a forgotten forum can unlock someone’s email, bank or company account years later.
This is why a breach is a chain, not an event: leak → aggregation into combolists → automated credential stuffing → account takeover. breachmonitor walks each link – and how to break it.
What gets exposed
Not all leaked data is equal
Different data types create different risks. Knowing what leaked tells you what to do first.
- PASSWORD
Login credentials
Email-and-password pairs are the crown jewels of a breach. Reused anywhere, they enable credential stuffing and account takeover across unrelated services.
- PII
Personal data
Names, addresses, phone numbers and dates of birth fuel targeted phishing, SIM-swapping and identity fraud – and they can’t be “changed” like a password.
- TOKEN
Session tokens & keys
Leaked session cookies, API keys or auth tokens can let an attacker in without a password at all, sometimes bypassing multi-factor authentication.
- FINANCE
Financial details
Card numbers and banking data enable direct fraud. Even partial data (last four digits, expiry) strengthens social-engineering and vishing attacks.
What to do first
Triage a leak by what it exposes
When you learn you’re in a breach, the exposed data type sets the urgency.
- Act now
Password leaked & reused
A password you use elsewhere is in the dump. Change it everywhere it’s reused and enable MFA immediately.
Signal: Credentials + reuse → account takeover risk
- This week
No MFA on key accounts
Email, banking and work accounts without a second factor are one leaked password away from takeover. Turn on MFA.
Signal: Single factor on high-value accounts
- Planned
Personal data exposed
PII can’t be reset, so treat it as permanent: expect targeted phishing and verify unusual requests independently.
Signal: PII leaked – phishing & identity risk
- Monitor
Old or already-rotated data
Data from an account you’ve since secured or closed. Keep monitoring in case it resurfaces in new combolists.
Signal: Historic data – low immediate risk
Free tool
Which account habits need attention?
Tick the risk factors that apply to you. The counter summarises your selections and suggests what to review – your answers are not sent to the server.
Interactive mode is not available. You can read the full reference content below. No answers are assessed and no result is calculated.
I reuse passwords across sites
The single biggest amplifier of a leak
Some key accounts have no MFA / 2FA
Email, banking, work, social
My email has appeared in a known breach
e.g. flagged by a breach-check service
I have old accounts I no longer use
Forgotten logins still hold your data
I don’t get alerts when my data leaks
No breach monitoring in place
Start with what you know
No factors are selected. This does not confirm that your accounts are safe. Review each item and investigate any confirmed leak separately.
Review the selected factor
An individual issue can matter. Change a compromised or reused password promptly, protect important accounts with phishing-resistant MFA, and verify any breach alert.
Plan the next account checks
Start with compromised or reused passwords and important accounts without MFA. Then review unused accounts and how you receive trustworthy breach alerts.
Work through the checklist
Use unique passwords, protect important accounts with phishing-resistant MFA, review confirmed exposure and retire unused accounts. These selections are a task list, not a probability or severity score.
Your checklist
0/5 factors selected
Start with what you know
No factors are selected. This does not confirm that your accounts are safe. Review each item and investigate any confirmed leak separately.
Review the selected factor
An individual issue can matter. Change a compromised or reused password promptly, protect important accounts with phishing-resistant MFA, and verify any breach alert.
Plan the next account checks
Start with compromised or reused passwords and important accounts without MFA. Then review unused accounts and how you receive trustworthy breach alerts.
Work through the checklist
Use unique passwords, protect important accounts with phishing-resistant MFA, review confirmed exposure and retire unused accounts. These selections are a task list, not a probability or severity score.
A local checklist, not an exposure measurement. It does not inspect accounts, search breach data or estimate the likelihood of a breach. No selected factors does not establish that your accounts are safe.
Want the actual exposure, not a checklist?
OffSeq Breach checks supported breach and combolist sources for exposure linked to your domains, and Threat Radar keeps watching after that. Your checklist answers are not attached to the enquiry.
Thank you – your enquiry has been received.
OffSeq will reply to the email address you entered.
Sending failed. Try again or email support@offseq.com.
The numbers
The scale of exposure
Leaked credentials aren’t rare events – they’re a standing, industrial-scale supply.
Each figure links to its primary source. Numbers are approximate and updated as new reports are published.
For security teams
Your employees’ passwords leak on services you don’t control
Credentials exposed by third-party breaches can be replayed against work accounts when passwords are reused. Monitoring can flag observed exposure; prompt investigation and account protection are still needed.
In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority … unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons.
The exemption is narrower than it reads: only an unlikely risk removes the duty, so an unresolved assessment is still notifiable. A notification later than 72 hours must be accompanied by reasons for the delay, and a processor notifies its controller without undue delay under Article 33(2).
-
Monitor for leaked credentials
Continuously check whether corporate emails and passwords appear in new breaches and combolists – before attackers try them against you.
-
Enforce MFA and unique passwords
Credential stuffing relies on reused credentials. Phishing-resistant MFA and unique passwords reduce takeover risk; weak MFA, stolen sessions and recovery paths can still be attacked.
-
Reduce your leaked attack surface
Exposed session tokens, API keys and forgotten accounts widen the blast radius. Find and retire them.
-
Have a response plan
GDPR’s 72-hour clock starts at awareness. Detection, containment and notification need to be rehearsed, not improvised.
Guides
Go deeper
Plain-English explainers on how leaks turn into attacks – and how to respond.
-
What is a data breach? Types, causes and consequences
A breach can affect data confidentiality, integrity or availability. Learn how breaches happen, what may be exposed and which response duties apply.
Read guide -
Credential stuffing: how one leaked password becomes account takeover
Attackers don’t guess passwords – they replay leaked ones. Here’s how credential stuffing turns an old breach into a hijacked account.
Read guide -
What to do after a data breach: a step-by-step response
Found out you’re in a breach? Here’s the order to act in – from the leaked password to monitoring for what comes next.
Read guide -
What breach monitoring actually does – and what it cannot tell you
Monitoring watches breach collections for your addresses and domains. Here is what that covers, what it silently misses, and when paying for it is worth it.
Read guide
Frequently asked questions
Short, clear answers
What is a data breach?
A data breach is any incident where data is accessed, disclosed or lost without authorisation. It ranges from a targeted intrusion to a misconfigured database left open online. Login credentials are one important category of leaked and abused data.
What is a credential leak?
A credential leak is the exposure of usernames and passwords, usually as a result of a breach. Leaked credentials are aggregated into “combolists” and replayed against other services in automated credential-stuffing attacks.
What is breach monitoring?
Breach monitoring continuously matches your addresses, domains or passwords against breach collections and combolists and alerts you when a new match appears. It reports observed exposure only: coverage is incomplete, and an alert can arrive after the credentials have already been used. What breach monitoring can and cannot tell you.
How do I know if my data has been breached?
Free services such as Have I Been Pwned show whether your address appears in the collections they cover. An absent result does not prove there has been no breach. Alerts help you investigate newly observed exposure, but may arrive after attackers have accessed the data.
What should I do if I’m in a breach?
Work through the response in order: change the affected password everywhere you reused it, enable multi-factor authentication on important accounts, and watch for phishing that references the leaked data.
Why is password reuse so dangerous?
Attackers try leaked email-and-password pairs on other services. Unique passwords prevent that reused-password route to other accounts. A compromised email account, stolen session or recovery mechanism can still affect other services.
Does multi-factor authentication stop credential leaks?
It doesn’t stop the leak, but it usually stops the takeover: a leaked password alone isn’t enough to log in. MFA is the single most effective defence against credential stuffing, though leaked session tokens can sometimes bypass it.
How do organisations monitor for leaked credentials?
They continuously match their domains and employee accounts against breach and combolist data, and alert or force a password reset on a match. Services such as OffSeq Breach and Threat Radar automate this.
Tell us what leaked, or might have
A supplier’s breach notice, a run of suspicious logins, a domain you want watched – describe it and OffSeq will reply with a suggested next step.
Thank you – your enquiry has been received.
OffSeq will reply to the email address you entered.
Sending failed. Try again or email support@offseq.com.