Business
For firms
External Exposure Check External Cybersecurity Assessment Monitoring Signed assessment record See it first How we use AI
By problem
Forged invoices Firm addresses in breach records Email anyone can fake Look-alike domains AI answers about your firm Insurance renewal Confidentiality rules
By sector
Law firms Accounting practices Dental and health clinics Financial advisers Insurance and mortgage brokers Real estate brokerages Trades and contractors Studios and wellness Restaurants and hospitality All sectors
Individual
Free address check Personal Exposure Briefing First three steps Check my address
Partners
Partner types
IT providers Accountants and bookkeepers Insurance brokers Associations Insurers Referral partners
Programme
How it works Become a partner Partner portal
Intelligence
Learn
Articles Weekly briefing Glossary Threat patterns
Research
Research studies Disclosure tracker Rules and frameworks
Tools
Free address check Request your outside reading Verify a record
Help
Help centre Questions and answers Contact
How we work
About
About us Careers Contact
How we work
Methodology What we never do Trust centre How we use AI
Legal
Privacy Terms Refund policy
Sign in Check my firm
Guides
Guide · Updated 30 Sep 2026

How to check whether your firm’s data was in a breach

Most firms whose staff passwords are in breach data were never broken into. The passwords leaked from other companies. Here is how to find out, and what each answer means.

Updated 30 Sep 2026Reading time 5 minBy LeakTrace

Why your firm can be exposed without being broken into

A staff member signs up for an online service with a work address. That service suffers a breach and its user list is shared. The firm’s own systems were never touched, but its address and a password now sit in a breach database, and the password may have been reused at work.

Three checks to run today

  1. Staff addresses in breach records. Check each address in a free public breach-notification service, one at a time, or use our free address check. A check of the whole domain at once usually requires proving you own it.
  2. Whether your email can be forged. Look up your domain’s DMARC record: nslookup -type=txt _dmarc.yourfirm.ca. No record, or p=none, means email in your name can be forged.
  3. Lookalike domains. Search two or three misspellings of your domain in a domain registration search and see which are registered.

Reading the results

Finding staff addresses in breach records is common. What matters is:

  • How recent the breach is, and whether the password has been changed since.
  • What was taken: a readable password comes before an encrypted one.
  • Two-step sign-in: an exposed password on an account protected by two-step sign-in is much less useful to anyone.
  • Password-stealing software: exposures from infected devices can include sign-in sessions and should be treated first.

Beyond passwords

The outside view of a firm also includes its email settings, its website software, old systems still online and domains it has forgotten. Each can be read from outside without logging in to anything. An External Cybersecurity Assessment reads all of it once, and every finding is human-verified; monitoring re-reads email settings, look-alike domains and new host names every hour, and repeats the rest every day.

What to do next

  1. Change the passwords of every exposed address, and anywhere those passwords were reused.
  2. Turn on two-step sign-in for email and remote access.
  3. Find out whether email can be forged in your firm’s name. It can be closed, in stages so that no real mail is lost, and the assessment gives the exact steps.