Sooner or later, almost everyone has an account at a company that gets breached. You usually find out months later, if at all, and by then the stolen email addresses and passwords may already be in circulation.
There is a free website that tells you whether that has happened to you: Have I Been Pwned, run by security researcher Troy Hunt. The name is hacker slang. To be "pwned" is to have been compromised.
What It Does
- Checks your email address: type in an address and the site shows which known data breaches included it, and what was exposed, such as passwords, phone numbers or addresses.
- Checks your passwords: its Pwned Passwords tool tells you whether a password has appeared in breaches. If it has, stop using it everywhere.
- Sends alerts: you can sign up to be notified if your address shows up in a future breach, so you hear about it early.
- Helps businesses: the domain search feature lets the owner of a company domain see which of its email addresses have appeared in breaches, once ownership is verified.
What to Do If You Show Up
Finding your address in a breach does not mean someone is in your accounts today. It does mean the clock is ticking, so act on it:
- Change the password on the breached service, and on any other account where you used the same or a similar password.
- Turn on two-factor authentication, starting with your email and your bank.
- Use a password manager so every account gets its own long, unique password.
- Watch for phishing. Breached details are often used to make scam emails look convincing, as described in our post on stopping phishing emails.
A Few Sensible Cautions
- Go to the real site by typing haveibeenpwned.com yourself. Look-alike sites exist, and a scam email can pose as a breach alert.
- Never type a password you currently use into any website that is not its own login page. If you want to test a password, test one you have already retired.
- A clean result is not a guarantee. The site only knows about breaches that have become public.
For Your Business
One staff member reusing a breached password can open the door to your whole company. That is why we pair checks like this with managed security, email protection and ongoing monitoring, so exposed accounts are caught and locked down before they are used against you.
Not sure where your business stands? Give us a call and we can check your company domain and walk you through next steps.