Find out which staff logins have leaked. Without ever seeing a password.
Our leaked staff credentials check finds email addresses on your domain that turn up in other companies' data breaches, and tells you how many of the leaked passwords are readable. It runs as part of an attack surface scan, so you check whenever you scan. It is for any business that wants to know whose password to change first.
What does the check show you? Who, how much, and from where.
Each scan of your domain looks for your staff addresses in other companies' breaches. Here is everything it records, and the one thing it never shows.
Affected email addresses
Each address on your domain, such as accounts@acme.co.uk, that appears in someone else's breach.
Leaked records
How many times your people's logins appear across the leaks.
People affected
How many different staff addresses are involved, so you know how many people to contact.
Readable passwords
How many leaked passwords were stored in the clear, so anyone holding the file could try them.
Where they came from
Which breaches each address turned up in, biggest first.
Never the password
We deliberately never display the passwords themselves, to you or anyone else.
Checked with each scan
The check runs when a scan of your domain runs. Scan again to check again.
In your own tools
Credential records as yes or no flags through the REST API, and through the MCP server for AI assistants.
How does it work? It comes with a scan.
There is no separate tool to set up. The check runs inside an attack surface scan of your domain, from your browser, with nothing installed on your network.
- Once per domain
Verify your domain
Add it and prove it is yours with a DNS record, through Cloudflare, with your work email address or by asking our team to review it.
- Whenever you like
Run a scan
Start an attack surface scan from your browser. The credential check is part of it.
- When it finishes
See who is affected
Open the scan's credential records: every affected address, with readable passwords marked.
- The same day
Ask people to change passwords
Contact everyone on the list, readable passwords first. Scan again later to check again.
Whose password needs changing? Every address, named.
Reveal the records on a scan and you get a plain list: each staff address that leaked, how many breaches it appears in, and whether a readable password leaked with it.
- Every affected address on your domain, with the number of leaked records and the breaches they came from.
- Readable or not. A readable password was stored in the clear in the leak, so anyone with the file can try it. Start with those.
- The password itself stays hidden. You learn who to contact, not their secret.
Exposed credentials · Records per address
What should those people do? Three things, today.
A leaked password is no longer a secret, even if the breach was years ago at a site that has nothing to do with work. The fix is quick once you know who it is.
- Change the work password for everyone on the list, starting with readable ones.
- Change it anywhere it was reused, because attackers try leaked logins on other sites.
- Turn on two-step login so a leaked password alone cannot get anyone in.
The same scan maps your hosts, open ports and certificates. See what an attack surface scan finds
Guidance shown with every result
Can I use it in my own tools? Yes, still without the passwords.
Your scripts can ask the REST API for a scan's credential records, and AI assistants such as Claude can ask our MCP server. Both get yes or no flags for each password, never the password.
Organisation data needs a key with organisation access, which you turn on when you create the key. More on the MCP server
No. We deliberately never display the passwords themselves. You see which addresses leaked, how many records, which breaches and whether a readable password leaked, so you know who should change it.
No. The check runs when an attack surface scan of your domain runs. There is no standing alert for new breaches, so run another scan whenever you want to check again.
The leaked data held that password in a form anyone can read, rather than scrambled. Anyone with the file could simply try it, so those people should change their password first.
Email addresses on the domain you scan, such as anything ending in @acme.co.uk. You can only scan a domain after proving it is yours.
Yes. With an API key that has organisation access, the REST API returns a scan's credential records with yes or no flags in place of passwords, and AI assistants can ask our MCP server for your exposed credentials.
Not necessarily. The records come from other companies' data breaches, where your staff used their work email address to sign up. The risk is that the same password was reused for a work login.
Know whose password to change. Before someone tries it.
See which staff addresses have turned up in other companies' breaches, which leaked passwords are readable and who to contact first. No password is ever shown.