Data breaches at LinkedIn, Canva, Adobe, and hundreds of other services have put billions of email/password combinations into criminal markets. If any of your staff use work email addresses for other online accounts, some of those credentials are almost certainly circulating. Here's how to find out — and what to do.
Have I Been Pwned (haveibeenpwned.com) — the free credential breach checking service run by Australian security researcher Troy Hunt — currently lists over 13 billion breached accounts. Type in any common business email domain and you'll almost certainly find staff email addresses that appear in one or more data breaches.
Finding your email in a breach database doesn't mean your accounts are compromised. It means that an attacker who purchased that breach data now has your email address and a password that you used at some point, somewhere. Whether that creates a real risk depends on: whether you reused that password, whether you've changed it since the breach, and whether MFA protects the accounts that matter.
The Real Risk: Password Reuse
A 2023 study by NordPass found that 64% of people use the same password across multiple accounts. For business accounts, the risk is that a password breached from an old LinkedIn account in 2016 is the same password currently in use for Microsoft 365 or a business banking portal. Attackers know this. Credential stuffing tools automate trying breached passwords against thousands of services simultaneously.
CERT NZ regularly sees credential stuffing as the entry point for business account compromises in New Zealand. The attacker didn't hack the business — they bought a breach database, ran a credential stuffing tool, and found that one of your staff's Microsoft 365 passwords was the same one they used for a subscription service that was breached three years ago.
What Dark Web Monitoring Does
Dark web monitoring services continuously scan criminal forums, paste sites, breach databases, and dark web marketplaces for your organisation's email addresses and any credentials associated with them. When a new breach appears that includes your domain, you're notified — typically within hours of the data appearing in criminal markets, rather than weeks or months later when the breach becomes public knowledge.
Optimyze includes dark web monitoring for all managed IT clients, with immediate notification when staff credentials appear in breach data. The notification includes which email address was found, which breach it came from, and recommended immediate actions — typically: change the password on the breached service, check for password reuse on business accounts, and confirm MFA is active.
What to Check Right Now
Go to haveibeenpwned.com and check your business email domain using the "Notify me" function. This gives you a one-time view of which staff addresses appear in breach data. For ongoing monitoring, a commercial service that covers your entire domain and provides breach-specific context is necessary — the free service only captures historical breaches, not new ones.
For any staff email addresses that appear in breach data: require immediate password change on the breached service, check for password reuse on business systems (enforce a password change on business accounts as a precaution), and confirm MFA is active on business email and critical systems.
Data breaches at other companies create real risk for your business if your staff reuse passwords. Dark web monitoring turns that unknown risk into an actionable notification — so you can respond before an attacker does.
