Leaked User Credentials Detected
Detects users with exposed credentials that appear in known data breach databases or dark web credential markets, as reported directly by the connected identity providers. This can indicate that either a user's own credentials may be compromised or that they are using common credentials, such as 'password', which are often found on exposed credential lists.
Compromised credentials enable unauthorized access through credential stuffing, where attackers use a valid stolen password to gain access to users' personal and corporate accounts and applications without triggering typical security controls.
Recommended Actions
Revoke all active sessions for the affected user and force an immediate password reset through the identity provider to ensure the compromised credential can no longer be used. Educate the user on the risks of reusing similar passwords across business and personal services.
Review recent login history and account activity for signs of unauthorized access, especially around sensitive apps, customer records, finance systems, or support tools, that may have occurred before the alert was generated so any misuse tied to the exposed credential is contained quickly. Pay particular attention for events from unfamiliar geographic locations, or unrecognized devices.
Require complex, unique passwords and strong multi-factor authentication methods to protect accounts even if future credentials are compromised. Ensure your organization is leveraging any functionality available within its Identity Provider(s) to block users from creating accounts using compromised credentials and automatically logs out and forces password resets upon detection of breached credentials.
Compatibility
Use Cases
An employee reuses their corporate password on a personal website that later suffers a breach, and the identity provider matched that exposed password to the employee's business account.
Credential-stealing malware on a personal device captures corporate login credentials that later appear listed for sale on a dark web marketplace, triggering the identity provider's risk detection for the associated account.
Real-World Incidents
Snowflake Customer Breaches — May 2024 Infostealer-harvested credentials were used to access over 160 companies' Snowflake environments with no MFA in place. Victims included AT&T, Ticketmaster, and Santander, with hundreds of millions of records stolen and significant ransom demands made. BleepingComputer, May 2024
Change Healthcare — February 2024 Stolen Citrix portal credentials with no MFA enabled allowed ALPHV/BlackCat ransomware operators to access Change Healthcare's systems undetected for 9 days, ultimately exposing the health records of approximately 190 million Americans. BleepingComputer, Apr 2024
ADT Breach via Stolen Credentials — October 2024 Attackers accessed ADT systems using stolen credentials from a third-party business partner, demonstrating how credential exposure at one organization can cascade into breaches at connected parties. BleepingComputer, Oct 2024
Last updated