Skip to content
All articles

Incidents · · 6 min read

Your company's email addresses are in a data breach – what now?

A practical checklist for the first hours and days after addresses on your domain turn up in a breach.

Värn

Editorial team

A person working on a laptop in a dark room with city lights outside

Email addresses on your domain turning up in a data breach rarely means that you have been hacked. Usually it is a service where an employee signed up with their work address – a forum, a web shop, a conference tool – that has leaked its user database. But the consequences can still land with you.

Why it matters

  • Reused passwords. If the employee used the same password at work, attackers can sign in directly (so-called credential stuffing).
  • Convincing phishing. With a name, a job title and the services the person uses, a targeted fraudulent email becomes far more persuasive.
  • Mapping. Lists of valid addresses make it easier to guess other addresses and attack the organisation more broadly.

The first hours

  1. Find out what leaked. Is it only email addresses, or passwords, phone numbers and addresses too? That decides the urgency.
  2. Change passwords for affected accounts if passwords were included – and for every other service where the same password was used.
  3. Check two-step verification for the email and administrator accounts of the people affected. If it is missing, turn it on now.
  4. Review sign-in logs in your email service for unusual sign-ins, new forwarding rules or new app permissions.

The next few days

  1. Inform the employees affected. Explain what leaked, that it is not their fault and which emails they should be extra suspicious of.
  2. Close unnecessary accounts. If the service is no longer used, close the account.
  3. Assess whether it is a personal data breach. Has your organisation been affected – or only a third-party service? If your own systems or data were affected, you may be obliged to notify the Swedish Authority for Privacy Protection (IMY) within 72 hours under the GDPR. Read IMY's guidance or ask your data protection officer.

Never download the breach yourselves

Leaked databases circulate on forums. Downloading them to "see what is in there" means you are processing other people's personal data yourselves – and risking malware. Use established services that show which accounts are affected without spreading the content.

Long-term protection

  • Password managers make unique passwords realistic.
  • Two-step verification makes leaked passwords far less useful.
  • A policy for work addresses – which services may employees sign up for with their work address?
  • Continuous monitoring so you find out when new breaches are published, instead of discovering it after an incident.

How Värn helps

Data breach monitoring in Värn is coming soon. Once it is switched on, Värn monitors your verified domains against Have I Been Pwned and shows which breaches affect you, which accounts are involved and which types of data were exposed. We never store passwords or content from the breaches – only what you need to be able to act.

More articles