In summary
- Almost all companies have team emails leaking data from other sites. The problem isn’t the email itself: it’s the same password being used at work.
- The Have I Been Pwned service allows you to check an entire domain after proving that it is yours. It is free for domains with up to 10 exposed addresses; above that, it requires a subscription.
- The answer has three parts: replace the affected passwords, MFA on all accounts, and a password manager to end the reuse.
- NIST, the American reference in digital identity, recommends comparing passwords with compromised password lists and requiring a change only when there are signs of compromise.
In this article
Knowing if your company's passwords are exposed It's simpler than it seems: with a service like Have I Been Pwned, and after proving that the domain is yours, you can see in minutes which team addresses appear in known data leaks and which ones do not. The next step is what really protects the company: ensuring that none of those passwords still opens a work account, and that a single password alone is no longer enough to get in.
Why does this happen to all companies?
Employees use their work email to register for online tools, conferences, stores, training platforms. When one of these services is attacked, the email list and passwords often end up being published or sold. Your company wasn’t attacked — but your team’s data is there.
If the password used on that site is the same as the one for Microsoft 365, the attacker already has the key. They don't need to guess anything.
How to verify your company: step by step
Individual verification
Anyone can search their own email on haveibeenpwned.com and see which known leaks appear. It is useful to raise awareness within the team, but it does not give the company's perspective.
Verification of the entire domain
To see all @suaempresa.pt addresses at once, Have I Been Pwned requires you to prove that you control the domain. There are four ways:
- Add a TXT record to the domain's DNS with the specified value.
- Place a meta tag on the website's homepage.
- Upload a small HTML file to the website's server.
- Clicking on a link sent to a domain administration address.
In practice, anyone who manages the DNS or the website can do this in a few minutes. According to the pricing page for the service, monitoring is free for domains with up to 10 exposed addresses; larger domains require a paid subscription, with tiers based on the number of exposed addresses.
Verify passwords, not just emails
The same service has a database of passwords that have already appeared in leaks, the Pwned Passwords, designed to be consulted without revealing the password to anyone who checks it. The U.S. National Institute of Standards and Technology (NIST) recommends exactly this: compare each new password with a list of common or compromised passwords and reject it if it matches. In Microsoft environments, there are equivalent protections that block weak or known passwords.
What to do next: the 4-step plan
| Pass | What to do | Suggested timeframe |
|---|---|---|
| 1. Screening | List the exposed addresses, the leaks in which they appear, and the date of each leak | Day 1 |
| 2. Exchange | Change the passwords of the affected accounts — starting with administrators, finance and management — and end open sessions | Days 1 to 3 |
| 3. MFA | Enable MFA on all accounts, without exceptions, and block old protocols that do not support it | Week 1 |
| 4. Password manager | Give each employee an enterprise password manager and end the reuse | Month 1 |
Exchange, but with discretion
For years, companies have required password changes every 90 days. NIST has stopped recommending it: the current guidance is not to force periodic changes, but to require them when there is evidence of compromise. Appearing in a data breach is exactly that evidence.
MFA: the piece that changes everything
With MFA, a stolen password no longer suffices — approval is required on the mobile device. According to Microsoft, MFA combined with blocking the old authentication locks out more than 99.9 percent of common account attacks. We explain the options in MFA: multi-factor authentication in the company.
Password manager: end the reuse
No one can memorize 40 different and long passwords. A password manager generates them, stores them, and fills them in. The NIST recommends that systems allow the use of these managers and the “paste” of passwords, and requires a minimum of 15 characters when the password is the only factor. See how to choose and implement it password manager for businesses.
Signs that an account has already been used
Showing up at an escape means that someone has already entered. But there are signs that require immediate action:
- Log-in starts from countries where the company does not operate.
- New email rules that forward messages out or delete them.
- Requests for MFA that the employee did not make — and that he may approve by mistake.
- Customers or suppliers who receive strange emails from the account, for example with a changed IBAN — we have dealt with this scam in Email fraud: the altered invoice.
For these signals to reach someone in time, monitoring with alerts is necessary — in the plans. IT Unlimited DataRoad is part of the included security, along with MFA and station protection.
A real case: 350 positions under security management
Ventask has been working with DataRoad since 2016. Today there are 350 seats in IT Unlimited, managing firewalls, endpoint security, remote work solutions, and maintaining cybersecurity solutions. In a company of this size, the question is never whether an email from the team appears in a breach, but how quickly an exposed account stops being an open door. Read the case Ventask: IT Unlimited with 350 workstations and firewalls and learn about our approach to cyber security for business.
Frequently Asked Questions
Is it a good idea to check if my company's emails are leaking data?
Yes, for your own domain. That's why Have I Been Pwned requires proof that you control it before showing the full list. The goal is to protect company accounts, not investigate the personal lives of employees.
If an email appears in a phishing scam, was the account hacked?
Not necessarily. It means that the email, and sometimes a password, was exposed in another service. The actual risk depends on whether that password is still being used at work and whether the account has MFA or not.
Should we require the team to change their password every month?
No. The current guidance from NIST is not to force periodic exchanges, but to require them when there are signs of compromise. Long, unique passwords stored in a manager and protected by MFA are more effective than frequent exchanges.
How often should we check the domain?
The ideal is continuous monitoring, with an alert whenever a new leak involving company addresses occurs. At a minimum, a quarterly check and another whenever a leak is reported in a service that the team uses.
Verification of exposed passwords within 5 working days
We checked your domain for known data leaks, identified the accounts at risk, confirmed MFA on all accounts, and have prepared a replacement plan and password manager for implementation. For companies with more than 10 seats · contract of assistance · remote, on-site, and telephone support.
Exposed passwords: verification in 5 working days
Be aware that accounts are leaking data — and close them.
Sources
- Have I Been Pwned — How do I verify my domain?
- Have I Been Pwned — Pricing (domains up to 10 exposed addresses free of charge)
- Have I Been Pwned — FAQs (Domain Search and Pwned Passwords)
- NIST SP 800-63B-4 — Authentication and Authenticator Management
- OWASP — Credential stuffing
- Microsoft Learn — Security defaults in Microsoft Entra ID
![mun[it] logo, a digital marketing agency — a DataRoad client](https://www.dataroad.pt/wp-content/uploads/2026/09/logo-cliente-munit.png){kind=logo}
