How to Check Whether Your Company Has Been Affected by a Data Breach

Signs of possible data loss

Companies often learn about an incident from third parties or side effects rather than noticing it themselves. Typical signs are:

• Logins at unusual times or from unexpected countries
• Password resets nobody requested
• Phishing emails that correctly mention internal names, projects or customers
• Notices from customers, partners or authorities about exposed data

Where to look

Breached data surfaces in different places: collections of known incidents, logs from malware that steals credentials, and forums or marketplaces on the dark web. A breach check evaluates such sources for a domain and shows which indicators exist for it.

The BreachFinder check reports known breaches for the domain, publicly known email addresses and an assessment of the domain's reputation. For legal reasons it may only be run for your own domains or with the domain owner's permission.

Step by step

• Check your domain: get the result of the free check.
• Identify affected accounts: which addresses and services appear?
• Change passwords and enable multi-factor authentication.
• Review access logs of the affected accounts for anomalies.
• If personal data is involved, check your notification duties (see the guide “What to do after a data breach”).

Limits of a check

A check shows known indicators in the sources it evaluates. No result does not prove that nothing happened – not every incident becomes public and no source is complete. If you want ongoing alerts, you need continuous monitoring rather than a one-time check.

Frequently asked questions

Related guides

• What to Do After a Data Breach: Immediate Steps and GDPR Notification
• Company Credentials Found on the Dark Web? Causes, Risks and Immediate Steps
• Dark Web Monitoring for Business: What It Does and Where the Limits Are