# Leaked staff credentials check | Precursor Intelligence

**Find out which staff logins have leaked. Without ever seeing a password.**

> Our leaked staff credentials check finds email addresses on your domain that turn up in other companies' data breaches, and tells you how many of the leaked passwords are readable. It runs as part of an attack surface scan, so you check whenever you scan. It is for any business that wants to know whose password to change first.

Canonical page: https://www.precursorintelligence.com/features/credential-exposure
Breadcrumb: [Home](https://www.precursorintelligence.com/) > [Features](https://www.precursorintelligence.com/features) > Leaked staff credentials check
Start free: https://www.precursorintelligence.com/register · Book a demo: https://www.precursorintelligence.com/contact

Checked with every scan. Passwords never shown. Nothing to install.

Example data on this page uses the fictional company Acme (acme.co.uk). Breach names are generic descriptions, not real companies.

## Contents

1. [What does the check show you?](#what-does-the-check-show-you)
2. [How does it work?](#how-does-it-work)
3. [Whose password needs changing?](#whose-password-needs-changing)
4. [What should those people do?](#what-should-those-people-do)
5. [Can I use it in my own tools?](#can-i-use-it-in-my-own-tools)
6. [Questions](#questions)
7. [Related features](#related-features)

## What does the check show you?

Each scan of your domain looks for your staff addresses in other companies' breaches. Here is everything it records, and the one thing it never shows:

1. **Affected email addresses.** Each address on your domain, such as accounts@acme.co.uk, that appears in someone else's breach.
2. **Leaked records.** How many times your people's logins appear across the leaks.
3. **People affected.** How many different staff addresses are involved, so you know how many people to contact.
4. **Readable passwords.** How many leaked passwords were stored in the clear, so anyone holding the file could try them.
5. **Where they came from.** Which breaches each address turned up in, biggest first.
6. **Never the password.** We deliberately never display the passwords themselves, to you or anyone else.
7. **Checked with each scan.** The check runs when a scan of your domain runs. Scan again to check again.
8. **In your own tools.** Credential records as yes or no flags through the REST API, and through the [MCP server](https://www.precursorintelligence.com/features/mcp-server) for AI assistants.

Example (Acme, scan of 16 October): 11 leaked records for 6 staff addresses, 4 of them with a readable password, from 5 separate breaches. The biggest source is an online retailer breach with 4 records.

## How does it work?

There is no separate tool to set up. The check runs inside an attack surface scan of your domain, from your browser, with nothing installed on your network.

1. **Verify your domain (once per domain).** Add it and prove it is yours with a DNS record, through Cloudflare, with your work email address or by asking our team to review it.
2. **Run a scan (whenever you like).** Start an attack surface scan from your browser. The credential check is part of it.
3. **See who is affected (when it finishes).** Open the scan's credential records: every affected address, with readable passwords marked.
4. **Ask people to change passwords (the same day).** Contact everyone on the list, readable passwords first. Scan again later to check again.

## Whose password needs changing?

**Credential records.** Reveal the records on a scan and you get a plain list: each staff address that leaked, how many breaches it appears in, and whether a readable password leaked with it.

- Every affected address on your domain, with the number of leaked records and the breaches they came from.
- Readable or not. A readable password was stored in the clear in the leak, so anyone with the file can try it. Start with those.
- The password itself stays hidden. You learn who to contact, not their secret.

Example (Acme): accounts@acme.co.uk (3 breaches, readable password), sam@acme.co.uk (2, readable), hr@acme.co.uk (2, readable), reception@acme.co.uk (2, not readable), it-support@acme.co.uk (1, readable), jo@acme.co.uk (1, not readable).

## What should those people do?

**Next steps.** A leaked password is no longer a secret, even if the breach was years ago at a site that has nothing to do with work. The fix is quick once you know who it is.

- Change the work password for everyone on the list, starting with readable ones.
- Change it anywhere it was reused, because attackers try leaked logins on other sites.
- Turn on two-step login so a leaked password alone cannot get anyone in.

The same scan maps your hosts, open ports and certificates. See what an [attack surface scan](https://www.precursorintelligence.com/features/attack-surface-management) finds.

## Can I use it in my own tools?

Yes, still without the passwords. Your scripts can ask the REST API for a scan's credential records, and AI assistants such as Claude can ask our MCP server. Both get yes or no flags for each password, never the password.

- REST API: `GET /my/scans/{scan_id}/credentials` returns each record's email address and breach source, with `has_plaintext_password` and `has_hashed_password` flags. No password is included.
- MCP server: the `list_my_exposed_credentials` tool. Example question: "Which Acme staff logins have turned up in data breaches?"

Organisation data needs a key with organisation access, which you turn on when you create the key. More on the [MCP server](https://www.precursorintelligence.com/features/mcp-server).

## Questions

### Will I see my staff's passwords?

No. We deliberately never display the passwords themselves. You see which addresses leaked, how many records, which breaches and whether a readable password leaked, so you know who should change it.

### Does it watch for new breaches all the time?

No. The check runs when an attack surface scan of your domain runs. There is no standing alert for new breaches, so run another scan whenever you want to check again.

### What does "readable password" mean?

The leaked data held that password in a form anyone can read, rather than scrambled. Anyone with the file could simply try it, so those people should change their password first.

### Which addresses does it check?

Email addresses on the domain you scan, such as anything ending in @acme.co.uk. You can only scan a domain after proving it is yours.

### Can I get the results into my own systems?

Yes. With an API key that has organisation access, the REST API returns a scan's credential records with yes or no flags in place of passwords, and AI assistants can ask our MCP server for your exposed credentials.

### Do the breaches mean we were hacked?

Not necessarily. The records come from other companies' data breaches, where your staff used their work email address to sign up. The risk is that the same password was reused for a work login.

## Related features

- [Attack surface management](https://www.precursorintelligence.com/features/attack-surface-management): map everything of yours that anyone online can reach, and see what changed since your last scan.
- [SSL certificate monitoring](https://www.precursorintelligence.com/features/ssl-certificate-monitoring): get a warning before your own SSL certificates expire, with every domain's certificate in one place.
- [Alerts and reporting](https://www.precursorintelligence.com/features/alerts-and-reporting): alerts by email, in the app or by webhook as soon as we spot something, plus PDF reports you can share.
- [MCP server](https://www.precursorintelligence.com/features/mcp-server): ask Claude, Cursor or any MCP assistant about your own estate and current threats, with real data behind the answer.
- [All features](https://www.precursorintelligence.com/features)

## Get started

Know whose password to change, before someone tries it. See which staff addresses have turned up in other companies' breaches, which leaked passwords are readable and who to contact first. No password is ever shown.

- Start free: https://www.precursorintelligence.com/register
- Book a demo: https://www.precursorintelligence.com/contact
- Nothing to install · Unlimited team members · Data stored in London · Two-factor sign-in for everyone