IDENTITY SECURITY / 3 MINUTE READ
When employee credentials leak: what to do next
A practical approach to assessing exposed employee credentials, reviewing account access, and choosing the right response for the evidence available.
Start with the finding
An alert that an employee’s credentials have surfaced online creates an immediate question: what does this mean for the business? The answer depends on the account, the source, the surrounding evidence, and what your team can establish about its current relevance.
Begin by recording the account identifier, where the finding surfaced, and when it was discovered. Preserve any available collection timestamp separately. The date your team finds a record is not necessarily the date it was stolen or first published.
Keep the evidence in an approved location with access limited to the people handling the investigation. A ticket can reference the finding without repeating an exposed password or other sensitive material in every notification.
Establish which account and access are involved
Use your directory, asset inventory, and authorized account records to establish whether the identity belongs to a current employee, a former employee, a contractor, or an unrelated person. Identify the service associated with the credential and the access that account is expected to have.
A privileged account, a customer-facing service, and a discontinued test account may require different responses. Those distinctions help determine who should own the investigation and how urgently the finding needs attention. Where there is credible evidence of ongoing misuse, activate your incident response process without waiting for every detail to be resolved.
Assess the evidence through your own systems and approved workflows. There is no need to attempt a login with an exposed password to decide that an account deserves review.
Review sessions and devices alongside passwords
Containment should reflect the type of exposure. A password-related finding may call for a reset and an account activity review. Evidence associated with an infostealer may also justify investigation of the affected device and any exposed session material.
Password changes and session revocation are distinct controls. Their effect depends on the identity provider and the application. Microsoft’s guidance, for example, distinguishes identity-provider tokens from sessions issued by individual applications. Confirm the relevant revocation behavior instead of assuming one action ends every form of access.
Use your established response procedures to coordinate identity and endpoint work. If a device may still be compromised, involve the endpoint team when planning credential recovery.
Record the decision and the follow-up
Document what the team established, what remains uncertain, which protective actions were taken, and who owns the next review. If a finding is judged to have limited current relevance, record the reasoning so the same evidence can be assessed consistently if it appears again.
Scryer supports this starting point by bringing credential exposure findings together with source context where available. The value is a clearer investigation: an account to review, evidence to examine, and a response grounded in what your team knows.