More than 1,000 leaked accounts their pen test never saw: why dark-web monitoring matters

Attackers rarely need to hack in when they can simply log in. Leaked usernames and passwords are cheap, plentiful and often still valid — and most organisations have no idea which of theirs are out there.

The reference case

A regulated body in Malaysia had a mature security programme, including an annual penetration test. When we checked breach and dark-web sources for its domain, we found more than 1,000 of its 40,000 member accounts exposed.

None of them appeared in the penetration test report. That isn't a criticism of the testers: a pen test examines your systems at a point in time. Leaked credentials live outside your systems, in places a pen test was never designed to look.

Anonymised reference case. Identifying details are withheld and figures are rounded.

How credentials end up on the dark web

• Third-party breaches. Staff and members reuse work emails — and often passwords — on other websites. When those sites are breached, your users' details leak with them.
• Infostealer malware. Malware on a personal or unmanaged device quietly harvests saved browser passwords and session cookies, then uploads them for sale.
• Phishing. Credentials captured by fake login pages are traded and resold.
• Combolists. Old breaches are repackaged into huge lists of email-and-password pairs used for automated attacks.

What attackers do with them

• Credential stuffing: trying leaked pairs automatically against your email, VPN, remote desktop and portals.
• Account takeover: logging in as a real employee or member, which most security tools treat as normal activity.
• Targeted phishing: using real names, roles and old passwords to make messages convincing.
• MFA fatigue: once they have a password, repeatedly pushing login prompts until someone approves one.

Because the attacker uses valid credentials, the first sign of trouble is often the ransomware itself.

What dark-web monitoring does

Dark-web and credential monitoring continuously searches breach databases, leak sites and underground sources for your domains, then tells you:

• which accounts are exposed, and whether they belong to employees, customers, members or third parties
• whether a readable password or a hash was leaked
• which breach the data came from, and when it appeared
• which exposures matter most — for example, staff accounts with a readable password

Good monitoring never shows passwords themselves, and it runs continuously rather than once a year, because new leaks appear every week.

What to do when you find leaked accounts

1. Prioritise employee and privileged accounts with readable passwords.
2. Force password resets and end active sessions for affected accounts.
3. Enforce MFA everywhere, starting with email, VPN and remote access — and prefer phishing-resistant methods.
4. Hunt for misuse: check logins from those accounts for unusual locations, times or devices.
5. Block password reuse by checking new passwords against known-breached lists.
6. Tell affected members or customers what to do, and consider your obligations under Malaysia's Personal Data Protection Act.
7. Keep watching — one clean-up doesn't stop tomorrow's leak.

How Fusion XDR helps

Fusion XDR's Dark Web & Credential Monitoring feeds leaks straight into the same console as your endpoint and network telemetry. When a leaked account suddenly logs in from somewhere new, Fusion XDR connects the two into one attack story instead of two unrelated alerts.

Frequently asked questions