How to check if your company emails were in a data breach

Yes, you can check whether your team's work email addresses appear in known data breaches. The quick route checks one address at a time. The route built for businesses is a domain search, which lists every address on your domain that has turned up in a breach, and which breaches they appeared in.

There is one firm rule. You check only a domain you own and control. This post explains how that check works, what the result means, and what to do with each address it lists.

Why a breach list matters for a business

When a website is breached, the stolen records often include email addresses and passwords. Staff often sign up to outside services with their work email. If one of those services is breached, the address and a password can end up in a public dump.

The risk for you is password reuse. If an employee used the same password on a breached service and on your email, VPN or accounting software, someone can try that password on your systems. A breach list tells you which addresses to look at first.

Check your own domain, not other people's

Have I Been Pwned (HIBP) is a public service that indexes known data breaches. It has a domain search feature. Its FAQ (opens in a new tab) says that multiple breached addresses can be retrieved by domain search only after you are verified as the owner.

This is the rule to keep in mind for the whole post:

Only search a domain your business owns and controls. Do not look up a client's, a competitor's or a former employer's domain, and do not look up individual people.

HIBP enforces this itself. Its subscription page (opens in a new tab) says you need to prove ownership or control of a domain before you can search it, and its API documentation (opens in a new tab) says an unverified domain returns an error. HIBP's help pages describe ways to show control of a domain, such as:

• adding a DNS record
• emailing a predefined address on the domain
• uploading a file to the website
• adding a meta tag to the home page

Your web developer or whoever manages your DNS can usually do any of these. If you do not know who controls your DNS, find that out first. It matters for much more than this check.

What it costs

HIBP's subscription page lists a free tier that monitors domains with up to 10 breached addresses, and its FAQ says larger domains normally need a subscription to see the search results. It also says that breaches flagged as not needing a subscription can be searched without one, whatever the domain size. Plans and limits change, so read the current subscription page (opens in a new tab) before you decide. Its table of plans shows a maximum domain size, in breached addresses, for each plan.

What the result does and does not mean

A domain search returns each address on your domain that appears in a known breach, and the names of the breaches. According to the API documentation, it returns only the part before the @ sign, and it includes sensitive breaches that the public single-address search hides.

Read the result carefully:

• A listed address is not proof that your systems were hacked. It means the address appeared in a breach of some other service. The breach name tells you which one and when.
• It does not tell you whether the password was the same one the person uses at work. You have to ask and assume the worst until you know.
• An address that is not listed is not proof of safety. The index only holds breaches it has already seen.
• HIBP does not send out exposed passwords. Its FAQ explains that any ability to send passwords to people would put them at greater risk. So the result will not show you a password.

Treat the list as a prompt for action, not as a verdict.

What to do for each exposed address

Go through this checklist for every address on the list. Do it in order.

1. Read the breach details. Note the service, the date, and what data was exposed.
2. Ask the owner of the address. Did they have an account on that service with their work email? Did they use a password they also use elsewhere?
3. Change the password on every account that might share it. Start with email, then banking, accounting, cloud and admin tools. Use a new, unique password for each.
4. Turn on two-step sign-in for those accounts if it is not already on.
5. Sign out other sessions in the email and cloud admin consoles, so any session opened with an old password ends.
6. Check the mailbox for odd rules. Look for forwarding rules or filters you did not create, and for sent mail the person does not recognise.
7. Tell the person plainly and without blame. The breach happened at another company.
8. Write down what you did and the date. If a client or regulator ever asks, you have a record.

If you find signs of real misuse, such as unknown forwarding rules or logins from places the person has never been, treat it as an incident. Some businesses in India have legal duties to report cyber incidents. Ask your lawyer which rules apply to you.

Never type a password into a random site

Do not paste a real password into a site that offers to "check" it, unless you trust that site. HIBP's Pwned Passwords page (opens in a new tab) says the check happens in your browser and only the first 5 characters of the password's SHA-1 hash are sent, and you can watch the request in your browser's developer tools. A simpler habit is safer still. When an address is exposed, change the password and do not test the old one anywhere.

Turn on two-step sign-in and stop password reuse

A breach list is a cleaning job. The lasting fix is to make a leaked password useless.

Two-step sign-in (also called MFA). Turn it on first for email, then for anything with money, customer data or admin rights. An app on the phone is a big step up from a password alone. A hardware security key or passkey is stronger still, because it is harder to trick out of a person on a fake sign-in page.

A password manager for the whole team. Staff reuse passwords because remembering many is hard. A manager creates and stores a different long password for each service. Choose a business plan so you can remove access when someone leaves.

A short rule for staff. Work email is for work accounts only, and no password is used twice. Put it in the onboarding checklist.

Set up alerts

You can check once, but new breaches appear all the time. Set up a way to be told.

HIBP lets people subscribe to notifications for an address they control, and its FAQ says notifications go only to the monitored address. For a whole domain, the options and limits depend on your plan, so check the current domain search page (opens in a new tab) after you sign in. Whichever route you pick, assign one named person to read the alerts and run the checklist above. An alert nobody reads protects nothing.

Also put a repeat date in the calendar. A quarterly look at the domain search results is a reasonable habit for a small business.

When an outside exposure check helps

The free and low-cost tools answer one question: do your addresses appear in known breaches? They do not tell you what else about your business is visible online, such as exposed login pages, old subdomains, leaked documents, fake sites using your name, or staff details that make phishing easier.

An exposure check covers those wider questions. At Hackers Family we run OSINT and digital exposure checks only on domains, brands and accounts that you own. Findings come ranked by risk, each with a clear fix. If you want that wider picture, or help acting on a long list of exposed addresses, that is the time to ask.