Business
For firms
External Exposure Check External Cybersecurity Assessment Monitoring Signed assessment record See it first How we use AI
By problem
Forged invoices Firm addresses in breach records Email anyone can fake Look-alike domains AI answers about your firm Insurance renewal Confidentiality rules
By sector
Law firms Accounting practices Dental and health clinics Financial advisers Insurance and mortgage brokers Real estate brokerages Trades and contractors Studios and wellness Restaurants and hospitality All sectors
Individual
Free address check Personal Exposure Briefing First three steps Check my address
Partners
Partner types
IT providers Accountants and bookkeepers Insurance brokers Associations Insurers Referral partners
Programme
How it works Become a partner Partner portal
Intelligence
Learn
Articles Weekly briefing Glossary Threat patterns
Research
Research studies Disclosure tracker Rules and frameworks
Tools
Free address check Request your outside reading Verify a record
Help
Help centre Questions and answers Contact
How we work
About
About us Careers Contact
How we work
Methodology What we never do Trust centre How we use AI
Legal
Privacy Terms Refund policy
Sign in Check my firm
Guides
Guide · Updated 30 Sep 2026

What is credential exposure?

Credential exposure means a work email address, and a password that was used with it, appear in a breach database someone else can read.

Updated 30 Sep 2026Reading time 4 minBy LeakTrace

In plain words

When a website a staff member signed up for suffers a breach, its list of addresses and passwords is often copied and shared. If that person used the same password for their work email, anyone holding the list can try it. Your firm was never broken into; the password simply became public somewhere else.

How credentials become exposed

  • Breaches at other companies. A staff member uses a work address to sign up for an online service. That service suffers a breach, and its user list is copied and passed around.
  • Password-stealing software. Malware on a personal or shared computer can copy the passwords saved in a browser, along with the sites they belong to.
  • Files published by mistake. Settings files, keys or passwords are sometimes left in a website's own code or in open cloud storage.

Why it matters to a firm

People reuse passwords. A password exposed with a work address can open email, remote access or cloud files if it was reused there. Automated tools try exposed address and password pairs against other services at scale, so the time between exposure and a sign-in attempt can be short.

If an exposed password leads to access to personal information, a breach-reporting duty can follow: under PIPEDA in Canada, and under state breach-notification laws in the United States.

What we read

Monitored breach databases and paste sites, and keys left in your own website's code. We do not log in to anything, and we do not visit criminal forums.

How often

For firms we monitor, a re-check every day, and a new exposure reaches you the same day we find it. A one-time External Cybersecurity Assessment reads it once and dates it.

What to do when an address is exposed

  1. Change the password on the exposed account and on every account where the same password was used.
  2. Turn on two-step sign-in for email first, then for remote access and cloud files.
  3. Ask your IT provider to review recent sign-ins and any new mail-forwarding rules on the account.
  4. Check whether the exposure touches personal information you hold, and whether a reporting duty applies.

Check one address now

Our free address check reads one email address against breach records and tells you what to do first: getleaktrace.com/individual.

Sources
  1. Personal Information Protection and Electronic Documents Act (PIPEDA), s. 10.1, breach of security safeguards, Government of Canada
  2. Office of the Privacy Commissioner of Canada, guidance on mandatory breach reporting