--- title: "Exposed passwords: audit your domain and close the door in 5 days" description: "One reused password can open the company's Microsoft 365. How to audit your domain against data breaches and neutralise the risk. No-obligation proposal." language: en url: https://www.dataroad-it.com/en/company-credentials-data-breach-check/ source: https://www.dataroad-it.com/en/company-credentials-data-breach-check/ publisher: DataRoad IT (DataRoad - IT Services and Consulting), Portugal --- > One reused password can open the company's Microsoft 365. How to audit your domain against data breaches and neutralise the risk. No-obligation proposal. # Exposed passwords: audit your domain and close the door in 5 days At a glance For decision-makers short on time. - 01 The risk is not an email in a breach: it is the same password opening a work account. - 02 Have I Been Pwned shows the whole domain once you prove you control it. - 03 Response: reset what is exposed, MFA on every account and a password manager. - 04 NIST says change only on signs of compromise, and a breach is one of those signs. ### In this article **A single reused password is all an attacker needs to get into the directors' email, change an IBAN on an invoice and divert a payment.** Passwords exposed in data breaches are the cheapest route to that attack. The good news: you can find out in minutes which company addresses are circulating in known breaches and close the door within a week: a domain audit, a reset of the affected credentials, mandatory MFA and a password manager. It is what managed cybersecurity from DataRoad - IT Services and Consulting applies by default. ## Why is your company already on these lists? Because the team uses their work address for everything: webinars, online shops, training platforms, trial tools. Any of those sites can be compromised. When that happens, the email/password pairs end up published or for sale. Nobody attacked your company. But if the employee reused that forum password on Microsoft 365, the intruder has nothing left to guess. The technical name is *credential stuffing*: software that automatically tests thousands of stolen credentials against dozens of services. OWASP, the international foundation dedicated to application security, attributes the success of this technique to people reusing the same email and password. Think of a lost key to the beach house that someone tries, just in case, in the office lock. ## How do you audit your domain for data breaches? **Personal search.** On haveibeenpwned.com, each person enters their own address and sees the known breaches that include it. It is useful for awareness; it is not a way to manage company risk. **Domain search.** To list every @yourcompany.pt address at once, Have I Been Pwned asks for proof that the domain is yours. It accepts four methods: - **TXT record** Added to DNS with the value supplied. - **Meta tag** Placed on the website homepage. - **HTML file** Uploaded to the hosting. - **Confirmation email** Sent to an administrative address on the domain. For whoever manages the DNS, it is a few minutes' work. The service's pricing table states that monitoring comes at no cost for up to 10 exposed addresses; above that there is a paid, tiered subscription. **Password search.** Pwned Passwords collects passwords already seen in breaches and lets you query it without revealing them. That is exactly what NIST, the US standards body, asks for: check every new password against lists of common or previously exposed passwords and reject it if it matches. The Microsoft ecosystem has similar mechanisms that block weak or already-seen choices. ## What should you do when exposed accounts appear? | Phase | Action | Window | | --- | --- | --- | | Assessment | Affected addresses, source breach and date of each | Day 1 | | Rotation | New passwords, starting with management, finance and the board; active sessions terminated | Days 1 to 3 | | Second factor | Mandatory MFA on every account; legacy protocols without MFA switched off | Week 1 | | Password vault | A business password manager for every person, an end to reuse | Month 1 | ### Is the 90-day password change over? Yes. NIST no longer recommends forced periodic changes. It recommends requiring a change when there is evidence of compromise, and an address in a breach is that evidence. ### Why is MFA the decisive step? Because it turns a stolen password into a useless object: without approval on the phone, there is no way in. Microsoft states that MFA, combined with blocking legacy authentication, stops more than 99.9% of common account takeover attempts. Details in [multi-factor authentication for businesses](https://www.dataroad-it.com/en/mfa-business-14-day-plan/). ### How do you put an end to reuse? With a password manager. Nobody memorises 40 long, distinct passwords; the manager generates, stores and fills in each one. NIST wants systems to accept these managers and the "paste" function, and sets 15 characters as the minimum when the password is the only factor. Selection criteria in [business password managers](https://www.dataroad-it.com/en/business-password-manager/). ## How can you tell someone is already inside an account? Being exposed is not the same as being compromised. These signs, however, demand an immediate response: - **Unlikely locations** Logins from places where the company has no activity at all. - **Unknown mail rules** Forwarding to outside addresses or automatic deletion of messages. - **Unexpected MFA prompts** Which someone might accept out of distraction. - **Odd messages to partners** Such as invoices with a changed IBAN; we explain the scheme in [altered invoice fraud](https://www.dataroad-it.com/en/email-fraud-changed-iban-ceo-fraud/). Detecting this in time requires monitoring with alerts. In the [IT Unlimited](https://www.dataroad-it.com/en/managed-it-services/) plans, it is part of the included security, together with the second factor and endpoint protection. ## How does this work in a 350-workstation company? Ventask has been a DataRoad client since 2016. It now has 350 workstations under IT Unlimited: managed firewalls, endpoint protection, secure remote working and the cybersecurity tools maintained by us. At that size there will always be some address in a breach; what counts is how quickly an exposed credential loses its value. Full case: [Ventask: 350 workstations and firewalls under management](https://www.dataroad-it.com/en/ventask-managed-firewalls-350-workstations/). Full approach: [managed cybersecurity](https://www.dataroad-it.com/en/managed-cybersecurity-services/). ## Frequently asked questions ### Can a company legally search for its email addresses in data breaches? Yes, as long as it is its own domain; the proof of control the service requires exists for exactly that. The purpose is to protect business accounts, not to monitor the private lives of the people who work there. ### Does an address in a breach mean the account has been hacked? No. It means the address, and sometimes the password, leaked from another service. The real danger depends on whether the password is reused at work and whether MFA is in place. ### Does it make sense to enforce monthly password changes? No. NIST's recommendation is to change on signs of compromise; long, unique credentials, in a vault and with MFA, protect more than frequent rotations. ### How often should the domain be audited? Continuously, with an alert for every new breach that includes company addresses. At a minimum, once a quarter and whenever a breach at a service the team uses becomes public. ## Next step: an exposed-credentials audit in 5 working days We search your domain in known breaches, flag every vulnerable account, check the second factor user by user and deliver a ready-to-run plan for rotation and the password manager. No-commitment proposal. **More than 10 workstations · support contract · remote, on-site and telephone support.** Call +351 211 459 950 * or write to sales@dataroad.pt. **Call to a Portuguese landline.* ## Sources - [Have I Been Pwned: verifying domain ownership](https://support.haveibeenpwned.com/hc/en-au/articles/15543011690767-How-do-I-verify-my-domain) - [Have I Been Pwned: subscription table](https://haveibeenpwned.com/Subscription) - [Have I Been Pwned: frequently asked questions](https://haveibeenpwned.com/FAQs) - [NIST: SP 800-63B-4 authentication standard](https://pages.nist.gov/800-63-4/sp800-63b.html) - [OWASP: credential stuffing attacks](https://community.owasp.org/attacks/Credential_stuffing) - [Microsoft Learn: security defaults in Entra ID](https://learn.microsoft.com/en-us/entra/fundamentals/security-defaults) Chosen by respected and international companies ★★★★★ 5,0 · 52 Google reviews ★★★★★ 5,0 · 52 Google reviews DataRoad ## Related articles [Managed IT and cybersecurityTeams on the move: securing laptops, phones and public Wi-FiThe real travel risk is an unencrypted lost laptop, not hotel Wi-Fi. With disk encryption, central management, MFA and a controlled connecti…12 October 2026 · 7 min read](https://www.dataroad-it.com/en/managed-cybersecurity-travelling-teams/)[Managed IT and cybersecurityExternal attack surface: what the internet sees of your companyAutomated attacks hunt for vulnerable versions, and company size is irrelevant. In 2025, CERT.PT recorded 3,864 incidents, 40% more than in …12 October 2026 · 5 min read](https://www.dataroad-it.com/en/external-attack-surface-managed-cybersecurity/)[Managed IT and cybersecurityNOC and managed cybersecurity: who watches your SME, and whenThe question is not whether you have a SOC: it is who receives the alert at 10 pm on a Saturday and what they do next. At DataRoad, nights, …12 October 2026 · 6 min read](https://www.dataroad-it.com/en/noc-managed-cybersecurity-sme/)[Managed IT and cybersecurityMicrosoft 365 security: the 10 controls that are yoursIn Microsoft 365, the platform is Microsoft's and the keys are yours. According to Microsoft, MFA and blocking legacy authentication stop mo…12 October 2026 · 6 min read](https://www.dataroad-it.com/en/microsoft-365-managed-cybersecurity-shared-responsibility/)[Managed IT and cybersecurityGDPR and managed cybersecurity: 10 technical controls to proveWithout documented technical measures, a data breach turns from an IT incident into a problem with the regulator. Ten controls in three bloc…12 October 2026 · 6 min read](https://www.dataroad-it.com/en/gdpr-managed-cybersecurity-10-technical-measures/)[Managed IT and cybersecurityAsset inventory: the basis of IT estate management and NIS2Without an asset inventory there is no planned renewal, no demonstrable security and no answer to CNCS. NIS2 entities must submit the list o…12 October 2026 · 7 min read](https://www.dataroad-it.com/en/it-asset-inventory-management-nis2/)[Managed IT and cybersecurityBreak-glass accounts in Microsoft 365: your company's insuranceA locked-out admin can leave email, Teams and files unmanaged for days. Break-glass accounts are the reserve administrator you only use when…12 October 2026 · 5 min read](https://www.dataroad-it.com/en/microsoft-365-break-glass-accounts/)[Managed IT and cybersecurityWindows 365 for business: when a cloud PC cuts costsA cloud PC pays off for consultants, seasonal staff, teams without an office and mixed Mac and Windows estates. For video, CAD or weak inter…12 October 2026 · 6 min read](https://www.dataroad-it.com/en/windows-365-business-cloud-pc-costs/)[Managed IT and cybersecurityManaged backup: the 30-minute restore test that proves itA backup never restored is a deferred risk. In 30 minutes, an old document, a deleted email and a server booted in isolation show whether th…12 October 2026 · 6 min read](https://www.dataroad-it.com/en/managed-backup-30-minute-restore-test/) Numbers you can verify **11** years in business **232** clients **< 10 min** average response time **15+** IT vendor certifications **10+** Countries with clients supported **5.0 ★** 52 Google reviews Transparency ## What many providers hide, we publish. [See plans and prices →](https://www.dataroad-it.com/it-unlimited/) - **Prices upfront** Essential from €395/month + VAT, Premium from €750 and Premium 365 from €1,200. - **No lock-in** Annual contract, no lock-in and no joining fees. - **Everything in writing** What is included, the scope and the price, before you sign. - **Support without counted hours** Remote and phone in every plan; on-site support from Premium. Partners and certifications DataRoad · Managed cybersecurity ## One StepAhead of IT. Security is proven over years, not promises. Managed firewalls, MFA, endpoint protection and tested backups, the same standard for every client. - **MFA** on every managed account - **11** years in business, since 2015 - **Top 5%** SMEs · scoring.pt We do **IT** right. DataRoad IT Unlimited ## Does your IT depend on a single person? Documentation, inventory and one contact who answers for everything. [Request a proposal, no commitment →](https://www.dataroad-it.com/en/#contact)+351 211 459 950 **Call to a Portuguese landline · More than 10 workstations · support contract · remote, on-site and phone support[Not sure what you need? Talk to the assistant →](https://www.dataroad-it.com/en/#assistente) --- Versão HTML desta página: https://www.dataroad-it.com/en/company-credentials-data-breach-check/