What is a breach-listed address?

What does breach-listed address mean?

This list should include passwords from previous breach corpuses, dictionary words used as passwords, and specific words (e.g., the name of the service itself) that users are likely to choose.

The breach is usually another service's: a supplier portal, a conference site, an old software account. Staff sign up with their work address. The service is breached. The list is shared.

The risk is reuse. If the password from that list still opens the firm's own mailbox, someone can sign in without phishing anyone. NIST's guidance asks services to refuse passwords found in earlier breaches for that reason.

A LeakTrace reading counts breach-listed addresses at the firm's own domain as an open way in, whatever the record says about passwords. It looks up only addresses at the firm's own domain, never anyone's personal accounts. The answer is the same in every case: a new password for each listed address and a second sign-in step.

Where does it show up in a reading?

In a LeakTrace reading it is read under “Firm addresses in breach data”: breach records for addresses at your own domain.

Which pages use this term?

• Was I in it? Breaches, by name
• Passkey
• Business email compromise