A password leak rarely announces itself. Credentials can appear in breach datasets, credential-stealer logs or criminal marketplaces after an unrelated service is compromised. If an employee has reused the same password for their work account, attackers can try those credentials against services such as Microsoft 365 without exploiting a technical vulnerability in your systems.
The consequences can include mailbox compromise, invoice fraud, exposure of personal data, wider account takeover and an incident that needs investigation under UK data protection rules. The original exposure may have happened at a retailer, app or website with no connection to your business. Your risk comes from password reuse and the security controls protecting the work account.
That is why knowing what to do if your company credentials appear on the dark web matters alongside measures designed to prevent compromise in the first place.
What actually happens after a leak
There is no reliable delay between credentials being exposed and criminals trying to use them. The NCSC specifically warns that stolen passwords can be exploited quickly, which is one reason it advises against relying on routine password expiry as a security measure.
Attackers commonly use credential stuffing or password-spraying techniques to test stolen or guessed credentials against other services. If a Microsoft 365 login succeeds, a compromised mailbox can give them access to conversations, contacts, attachments and information about how the organisation operates.
Attackers may also create forwarding or inbox rules designed to hide messages or send information elsewhere. Microsoft documents malicious inbox manipulation as a recognised sign of account compromise. That can become business email compromise if the attacker impersonates an employee or interferes with genuine payment conversations.
The costs are not evenly distributed
The UK Government’s 2025/26 Cyber Security Breaches Survey found that 3% of UK businesses suffered cyber facilitated fraud during the previous 12 months.
Among businesses experiencing cyber-facilitated fraud that reported a financial cost greater than zero, the median perceived cost was £500. The 90th percentile was £15,000. Including incidents where businesses reported no financial cost, the median was £110 and the 90th percentile was £12,000.
Those are perceived direct costs and should not be treated as a prediction of what an individual incident will cost. They do, however, illustrate the uneven nature of cyber losses: many incidents have limited direct cost, while a smaller number become considerably more expensive.
| Consequence | What it can look like in practice | Potential business impact |
|---|---|---|
| Mailbox takeover | Hidden rules, forwarding and unauthorised mailbox access | Investigation, containment and account remediation |
| Invoice redirection fraud | Genuine payment conversation altered or impersonated | Direct financial loss and recovery work |
| Data exposure | Personal or confidential information accessible from the account | Risk assessment and possible ICO notification |
| Lateral movement | Reused credentials work on another system or privileged account | Wider incident response and potential service disruption |
| Reputational damage | Customers or partners affected by the compromise | Client concerns, procurement questions and renewal risk |
Senior and privileged employees deserve particular attention because their accounts may provide access to sensitive communications, approval processes or administrative functions. Dark web monitoring for executives can form part of that risk management.
A familiar scenario
Imagine a 45-person firm receives an alert that a sales manager’s business email address has appeared in a credential leak. The information looks old, so the alert is dismissed.
That is not enough to establish that the Microsoft 365 account is safe. The exposed password may have been reused elsewhere, related personal accounts may also be compromised, or an attacker may already have obtained a valid session or application permission.
Working through how to respond to a dark web alert properly means establishing what was exposed, whether the credentials were reused and whether there are signs of unauthorised access.
Why MFA is not the full answer
Multi-factor authentication significantly reduces the risk from stolen passwords and should be enabled wherever possible. The 2025/26 government survey found that 47% of UK businesses required two-factor authentication, up from 40% the previous year.
However, not every MFA method offers the same resistance to phishing. Attacks such as device code phishing against Microsoft 365 MFA can abuse legitimate Microsoft authentication flows by persuading a user to complete an attacker-initiated sign-in.
Microsoft recommends stronger controls including Conditional Access and phishing-resistant authentication for higher-risk accounts. Configuring these appropriately through Microsoft Azure and identity services can provide stronger protection than simply adding more password complexity rules.
The NCSC advises organisations not to enforce routine password expiry because users commonly respond by making predictable variations of previous passwords. Strong unique passwords, password managers and passkeys and FIDO2 provide a better direction of travel.
What to do in the first 48 hours
- Reset the exposed work account and any other account known to use the same password.
- Revoke active sessions so a password reset does not leave existing access tokens usable.
- Review mailbox rules, forwarding settings, authentication methods and connected applications.
- Check Microsoft Entra sign-in and audit logs for suspicious activity.
- Establish whether personal or confidential data was accessed or disclosed.
- Alert finance teams to verify unexpected requests to change supplier or payment details.
- Preserve evidence before removing suspicious configurations where an investigation may be required.
An exposed credential does not automatically mean that you must notify the ICO. Under UK GDPR, a personal data breach must be reported to the ICO without undue delay and, where feasible, within 72 hours of becoming aware of it if the breach is likely to result in a risk to people’s rights and freedoms. The organisation must assess the circumstances rather than treating every credential alert as a reportable breach.
Detection also needs to be continuous rather than an annual exercise, which is where managed SOC services can help. Sensible password practices reduce exposure, while tested business continuity plans help the organisation respond when preventative controls fail. If you are assessing the business case, our view on dark web monitoring for SMBs explains what the service can and cannot tell you.
Find out what is already out there
A credential appearing in a breach dataset does not prove that your business account has been compromised, but it is a signal worth investigating. As a managed service provider in London, Northern Star can assess exposed credentials associated with your organisation and identify the accounts and controls that need attention.
If you would prefer a wider review first, our IT consulting services can assess where identity risk sits across your environment. Call 0800 319 6032 or book a callback.
