Skip to main content
Credential exposure findings represent one of the highest-severity categories in external attack surface management — a leaked password is an open door for attackers. Unlike vulnerabilities that require an exploit chain, a valid username and password combination gives an adversary immediate, authenticated access to your systems. Leverage Cyber continuously monitors breach databases, paste sites, dark web marketplaces, and threat intelligence feeds to surface credential exposures tied to your organization’s domains and email addresses before attackers can weaponize them.

​
Types of Credential Exposure

Not all credential exposures carry the same risk. The type of data exposed, the account it belongs to, and the service it protects all determine how urgently you need to act.
A plaintext password breach is the most severe credential finding. The exposed password is directly usable for credential stuffing — automated tools can immediately attempt to authenticate against your VPN, email, SSO, or any other service where the user may have reused the password. There is no cracking step required. Any plaintext breach for an active corporate account should be treated as an active compromise and escalated immediately, regardless of the breach’s age. Attackers routinely use years-old breach data because password reuse rates remain high across industries.
A hashed password breach exposes a cryptographic hash of the password rather than the plaintext value. The risk level depends on the hashing algorithm: MD5 and SHA-1 hashes can be reversed through rainbow tables or GPU-based cracking in minutes; bcrypt and Argon2 hashes are significantly more resistant. For privileged accounts — executives, administrators, IT staff — treat all hashed breaches as equivalent to plaintext exposure. Attackers prioritize high-value accounts and invest cracking resources accordingly. Require an immediate password reset and do not wait to confirm whether the hash has been cracked.
An exposure limited to a username or email address without a corresponding password is rated lower severity, but it is not benign. This data enables targeted phishing campaigns with credible personalization, account enumeration attacks against your login portals, and business email compromise (BEC) attempts. When Leverage Cyber finds a large number of employee email addresses in a single breach, it signals that your organization was a deliberate target of that breach, which elevates the risk context for the entire finding set.
An exposed API key or service token is functionally equivalent to a plaintext password — it grants direct, authenticated access to the service it belongs to. API keys are often found in public GitHub repositories, misconfigured CI/CD artifacts, or breach datasets from compromised developer tools. Unlike a user password, an API key may have broad, non-interactive permissions and may not be subject to MFA or login monitoring. Revoke and rotate any exposed API key immediately. Assume the key has been used since the moment it was exposed and investigate service logs for unauthorized activity during that window.

​
Severity Classification

Leverage Cyber assigns severity to credential findings using four factors evaluated in combination:
  • Account Type — Executive accounts, IT administrators, and privileged service accounts receive elevated severity because they represent higher-value targets and typically have broader access. A leaked CEO email address with a plaintext password is a Critical finding regardless of which service it belongs to.
  • Password Status — Plaintext passwords are always rated higher than hashed passwords. For hashed passwords, weak algorithms (MD5, SHA-1, unsalted SHA-256) are treated as near-plaintext given modern cracking capabilities.
  • Service Type — Credentials for VPN, RDP, SSO, email, or identity providers are rated Critical. Credentials for low-sensitivity marketing or productivity tools are rated High or Medium, acknowledging that password reuse may still provide lateral movement paths.
  • Breach Age — Recent breaches (within the last 90 days) receive elevated severity because they are more likely to be actively traded and exploited. Older breaches receive a moderate severity reduction unless the account is still active and the password is likely unchanged.

​
Finding Fields

Each credential exposure finding in the Leverage Cyber dashboard includes the following structured fields.
​
string
required
The full email address of the affected account. This is the primary identifier used to match the exposure to your organization’s domain.
​
string
required
The name or identifier of the breach dataset or source where the credential was discovered. This may be a named breach (e.g., a known public data breach), a dark web market listing, or an anonymous paste site.
​
string
required
The date the breach is estimated to have occurred or was publicly disclosed. Used to calculate breach age and adjust severity scoring. Format: YYYY-MM-DD.
​
enum
required
The format of the exposed credential. Possible values: plaintext, hashed_weak, hashed_strong, not_present. Directly influences severity classification and recommended response urgency.
​
enum
required
The classification of the affected account based on its role and access level. Possible values: executive, administrator, privileged_service, standard_employee, contractor. Higher-privilege accounts receive elevated severity scores.
​
enum
required
The composite severity rating assigned to this finding. Possible values: critical, high, medium, low. Derived from account type, password status, service type, and breach age.
​
string
required
The specific remediation action recommended for this finding, tailored to the account type and password status. Examples include immediate password reset, MFA enforcement, API key rotation, or account suspension pending investigation.

​
Immediate Response Steps

When a credential exposure finding appears in your dashboard, follow these steps in order. Speed matters — the window between a credential appearing in a breach dataset and its first attempted use can be hours, not days.
1

Force an Immediate Password Reset

Use your identity provider or directory service to force a password reset for the affected account. Do not send a self-service reset email and wait — invalidate the current credentials immediately so any attacker already in possession of them cannot authenticate. If the account belongs to an executive or administrator, have your IT team initiate the reset directly rather than relying on automated workflows.
2

Enable or Verify MFA on the Account

Confirm that multi-factor authentication is active on the affected account before the user re-authenticates. If MFA was already enabled, verify that it is functioning correctly and that no MFA bypass or recovery code has been recently used. If MFA was not previously enforced, enable it now and require enrollment before the account is restored to service.
3

Review Account Audit Logs for Unauthorized Access

Pull the authentication and activity logs for the affected account and look for logins from unfamiliar IP addresses, geographic anomalies, unusual session times, or access to sensitive resources outside the user’s normal patterns. Check logs from the estimated breach date forward. If you find evidence of unauthorized access, escalate to your incident response process immediately.
4

Notify Your Security Team and Document the Incident

Log the finding, your response actions, and the outcome in your incident tracking system. Notify your security team or CISO even if no unauthorized access is found — credential exposures are reportable events under many compliance frameworks, and maintaining a documented response record protects you during audits. Update the finding status in the Leverage Cyber dashboard to In Remediation and then Resolved once the password reset and MFA verification are complete.
Treat every credential finding as an active compromise until the password has been changed and MFA has been verified. Do not assume that a breach is “old” and therefore no longer a risk. Adversaries store and trade breach data for years, and password reuse across personal and corporate accounts means that credentials from unrelated breaches can still open doors into your environment. The age of a breach tells you when the data was stolen — it does not tell you when it will be used.