Responding to exposed credentials

Confirm the affected account

Check whether the identifier belongs to a current employee, former employee, customer, or service account. Identify the associated application where possible and confirm which team owns the account.

Review the available source context and dates. Determine whether the finding includes a password, a password hash, session material, or an account identifier alone. Do not test an exposed credential by attempting to sign in.

Assess the urgency

Consider the account’s access, whether it remains active, and any evidence of recent misuse. Privileged access, sensitive applications, and related internal alerts can increase the urgency of the response.

Use the finding to guide checks in your approved identity, endpoint, and application tools. Suspicious sign-ins or account changes may justify escalation through your incident response process.

Coordinate containment

Have the responsible administrators apply the actions appropriate to the incident. These may include resetting a password, restricting access, revoking sessions, or rotating exposed secrets.

Review session handling separately from the password change. Applications may issue and manage their own sessions, and revocation can depend on application behavior. Verify the relevant controls and their effect in each affected service.

Investigate associated devices and activity

Where the finding includes device or infostealer context, involve the endpoint team. Review available telemetry to assess whether the device remains compromised and follow your established containment and remediation procedures.

Check the relevant activity around the suspected exposure period. Document signs of unauthorized access, unusual account changes, or access to sensitive resources. Expand the investigation when the evidence supports it.

Verify and close the response

Confirm that the agreed containment and remediation actions were completed. Record who performed them, when they occurred, and how their effectiveness was checked.

Close the case when your response criteria are met. Keep the exposure record and the response outcome distinct: a record may remain visible in external sources after access has been secured. Define any follow-up monitoring or review before handing the case back to the account owner.

Next guide: Handling sensitive intelligence