Data breach monitoring
Coming soon. How monitoring of known data breaches will work – and what is never stored.
Coming soon – not switched on yet
Data breach monitoring is built but not yet active. It launches once the agreement with the data source is in place. Until then, no breach checks are run and nothing is shown under Data breaches in the app. This page describes how it will work.
Värn will monitor whether email addresses on your verified domains appear in known data breaches. Monitoring is planned for the Business and Enterprise plans.
Source
Värn will use Have I Been Pwned (HIBP), an established service that collects and verifies published data breaches, and its search by domain in accordance with its terms.
Turning on monitoring
Once monitoring has launched:
- Verify the domain in Värn.
- Turn on Data breach monitoring under Settings → Monitoring (requires an administrator).
- HIBP requires the domain to be approved with them as well. We handle this for you – until then, Värn shows the domain as awaiting approval from the source.
After that, the domain is checked daily.
What is stored – and what is not
| Stored | Never stored |
|---|---|
| The breach name and date | Passwords or password hashes |
| Types of exposed data | The content of the breach |
| Which accounts on your domain are affected | Data about people outside your domain |
Details of data breaches are only shown to members and administrators, not to users with the viewer role.
What you should do if accounts are affected
- Change the password for affected accounts and make sure it is not reused anywhere else.
- Turn on two-step verification for affected accounts – especially email and administrator accounts.
- Watch out for targeted phishing aimed at the people affected.
- Close accounts with the service if they are no longer used.
Read more in the article Your company's email addresses are in a data breach – what now?
No source covers everything
Finding nothing does not mean no data has leaked – only that it is not in the breaches the source knows about.
Demo mode
For demonstrations, an installation can allow clearly labelled, synthetic sample data. Such records are always shown with the label Demo data and are never included in notifications, the security posture or reports.