The risk is not the email appearing in a breach: it is the same password opening a work account. Change what is exposed, MFA on every account and a password manager.
More than 10 workstations · support contract · remote, on-site and phone support
For decision-makers short on time.
A single reused password is all an attacker needs to get into the directors' email, change an IBAN on an invoice and divert a payment. Passwords exposed in data breaches are the cheapest route to that attack.
The good news: you can find out in minutes which company addresses are circulating in known breaches and close the door within a week: a domain audit, a reset of the affected credentials, mandatory MFA and a password manager. It is what managed cybersecurity from DataRoad - IT Services and Consulting applies by default.
Because the team uses their work address for everything: webinars, online shops, training platforms, trial tools. Any of those sites can be compromised. When that happens, the email/password pairs end up published or for sale.
Nobody attacked your company. But if the employee reused that forum password on Microsoft 365, the intruder has nothing left to guess.
The technical name is credential stuffing: software that automatically tests thousands of stolen credentials against dozens of services. OWASP, the international foundation dedicated to application security, attributes the success of this technique to people reusing the same email and password. Think of a lost key to the beach house that someone tries, just in case, in the office lock.
Personal search. On haveibeenpwned.com, each person enters their own address and sees the known breaches that include it. It is useful for awareness; it is not a way to manage company risk.
Domain search. To list every @yourcompany.pt address at once, Have I Been Pwned asks for proof that the domain is yours. It accepts four methods:
For whoever manages the DNS, it is a few minutes' work. The service's pricing table states that monitoring comes at no cost for up to 10 exposed addresses; above that there is a paid, tiered subscription.
Password search. Pwned Passwords collects passwords already seen in breaches and lets you query it without revealing them. That is exactly what NIST, the US standards body, asks for: check every new password against lists of common or previously exposed passwords and reject it if it matches. The Microsoft ecosystem has similar mechanisms that block weak or already-seen choices.
| Phase | Action | Window |
|---|---|---|
| Assessment | Affected addresses, source breach and date of each | Day 1 |
| Rotation | New passwords, starting with management, finance and the board; active sessions terminated | Days 1 to 3 |
| Second factor | Mandatory MFA on every account; legacy protocols without MFA switched off | Week 1 |
| Password vault | A business password manager for every person, an end to reuse | Month 1 |
Yes. NIST no longer recommends forced periodic changes. It recommends requiring a change when there is evidence of compromise, and an address in a breach is that evidence.
Because it turns a stolen password into a useless object: without approval on the phone, there is no way in. Microsoft states that MFA, combined with blocking legacy authentication, stops more than 99.9% of common account takeover attempts. Details in multi-factor authentication for businesses.
With a password manager. Nobody memorises 40 long, distinct passwords; the manager generates, stores and fills in each one. NIST wants systems to accept these managers and the "paste" function, and sets 15 characters as the minimum when the password is the only factor. Selection criteria in business password managers.
Being exposed is not the same as being compromised. These signs, however, demand an immediate response:
Detecting this in time requires monitoring with alerts. In the IT Unlimited plans, it is part of the included security, together with the second factor and endpoint protection.
Ventask has been a DataRoad client since 2016. It now has 350 workstations under IT Unlimited: managed firewalls, endpoint protection, secure remote working and the cybersecurity tools maintained by us. At that size there will always be some address in a breach; what counts is how quickly an exposed credential loses its value.
Full case: Ventask: 350 workstations and firewalls under management. Full approach: managed cybersecurity.
Yes, as long as it is its own domain; the proof of control the service requires exists for exactly that. The purpose is to protect business accounts, not to monitor the private lives of the people who work there.
No. It means the address, and sometimes the password, leaked from another service. The real danger depends on whether the password is reused at work and whether MFA is in place.
No. NIST's recommendation is to change on signs of compromise; long, unique credentials, in a vault and with MFA, protect more than frequent rotations.
Continuously, with an alert for every new breach that includes company addresses. At a minimum, once a quarter and whenever a breach at a service the team uses becomes public.
We search your domain in known breaches, flag every vulnerable account, check the second factor user by user and deliver a ready-to-run plan for rotation and the password manager. No-commitment proposal.
More than 10 workstations · support contract · remote, on-site and telephone support.
Call +351 211 459 950 * or write to sales@dataroad.pt.
*Call to a Portuguese landline.
Chosen by respected and international companies
![MUN[it]](/assets/img/logos-c/munit.webp "MUN[it]"){kind=small}
★★★★★ 5,0 · 52 Google reviews
The real travel risk is an unencrypted lost laptop, not hotel Wi-Fi. With disk encryption, central management, MFA and a controlled connecti…
· 7 min read
Automated attacks hunt for vulnerable versions, and company size is irrelevant. In 2025, CERT.PT recorded 3,864 incidents, 40% more than in …
· 5 min read
The question is not whether you have a SOC: it is who receives the alert at 10 pm on a Saturday and what they do next. At DataRoad, nights, …
· 6 min read
In Microsoft 365, the platform is Microsoft's and the keys are yours. According to Microsoft, MFA and blocking legacy authentication stop mo…
· 6 min read
Without documented technical measures, a data breach turns from an IT incident into a problem with the regulator. Ten controls in three bloc…
· 6 min read
Without an asset inventory there is no planned renewal, no demonstrable security and no answer to CNCS. NIS2 entities must submit the list o…
· 7 min read
A locked-out admin can leave email, Teams and files unmanaged for days. Break-glass accounts are the reserve administrator you only use when…
· 5 min read
A cloud PC pays off for consultants, seasonal staff, teams without an office and mixed Mac and Windows estates. For video, CAD or weak inter…
· 6 min read
A backup never restored is a deferred risk. In 30 minutes, an old document, a deleted email and a server booted in isolation show whether th…
· 6 min readNumbers you can verify
Partners and certifications
DataRoad · Managed cybersecurity
Security is proven over years, not promises. Managed firewalls, MFA, endpoint protection and tested backups, the same standard for every client.
We do IT right.
Documentation, inventory and one contact who answers for everything.
