In this guide · 8 sections
- 01What a data breach exposure means for your business
- 02How to run a domain search on Have I Been Pwned
- 03How to respond to each exposed account
- 04Stop one leak from opening other accounts
- 05Is this a PDPA data breach?
- 06Make it routine: monthly and quarterly checks
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
Verify your domain at Have I Been Pwned (DNS TXT record, email, file or meta tag), then run a domain search to list affected addresses and breaches. For each one, reset any reused password, make sure MFA is on, and check the account for unusual sign-ins.
What a data breach exposure means for your business
When a website or app is breached, attackers often publish or sell its user list: email addresses, names, and sometimes passwords or password hashes. If a staff member signed up with their work email and reused their work password, attackers can try that pair against your Microsoft 365 or Google Workspace login. This is called credential stuffing.
| What was exposed | Risk to your business | Urgency |
|---|---|---|
| Email address only | More targeted phishing to that person | Low: awareness |
| Email plus name, phone, job title | Convincing phishing and impersonation | Medium: brief the person |
| Email plus password or hash | Login attempts on email and other accounts | High: reset reused passwords, check MFA |
| Stealer log entry | Malware captured logins on a device | Very high: treat device and accounts as compromised |
HIBP explains that stealer logs come from malicious software on infected machines that collects email addresses, passwords and the sites they were entered into. A stealer log entry for a work address means a computer, possibly a personal one, was infected while someone logged in.
How to run a domain search on Have I Been Pwned
Anyone can check a single address for free at haveibeenpwned.com. Checking all addresses on your company domain needs you to prove you control it, so nobody else can list your staff's exposures.
Sign in to the HIBP dashboard
Enter your work email; HIBP sends a link to confirm you can receive mail at that address.
Add your domain
Choose to add a domain you own or control.
Verify control of the domain
HIBP's API documentation lists the options: add a DNS TXT record, send an email from one of several pre-defined addresses, upload a file to the website, or add a meta tag to the home page. A TXT record at your DNS host is usually quickest.
Run the domain search
The result lists each breached address on your domain and the breaches it appeared in. Export it to a spreadsheet.
Turn on notifications
Keep the domain in your dashboard so HIBP can alert you when a new breach includes your addresses.
How to respond to each exposed account
Don't panic over a long list. Many entries are old breaches of sites nobody uses any more. Sort by breach date and by what was exposed, then work through the list.
Per-person response
If you find signs that a mailbox was actually accessed, such as unknown forwarding rules or sent messages nobody wrote, switch to our hacked business email guide straight away.
Stop one leak from opening other accounts
Resetting passwords after each breach is reactive. Three habits make breached passwords far less useful to attackers.
- MFA everywhere. CSA's password and 2FA guidance recommends turning on two-factor authentication for email and other accounts. With MFA, a stolen password alone isn't enough. Our MFA set-up guide covers Microsoft 365 and Google Workspace.
- A password manager. Unique passwords for every site mean one breach exposes one account. CSA suggests long passwords of at least 12 characters; a manager makes that practical. See our password manager guide.
- Block known-breached passwords. NIST guidance recommends checking new passwords against breached password lists, and HIBP's Pwned Passwords service exists for that purpose.
Is this a PDPA data breach?
An employee's work address appearing in another company's breach is generally that company's incident, not yours. It doesn't by itself mean your organisation has a data breach to report. But if the review shows that someone accessed your systems and personal data held by your business, such as customer records in a mailbox, the PDPA's breach assessment and notification duties may apply.
The PDPC's data breach reporting page is where organisations report. The general approach is to assess a suspected breach promptly and notify the PDPC and affected individuals where it meets the notification criteria. This guide is not legal advice; if customer data may have been accessed, get advice early.
Make it routine: monthly and quarterly checks
Breach checking works best as a small routine, not a one-off scare.
| When | What to do |
|---|---|
| On every new HIBP alert | Identify the person and breach, apply the per-person response |
| Monthly | Review sign-in alerts in Microsoft 365 or Google Workspace |
| Quarterly | Re-run the HIBP domain search and compare with last quarter |
| When staff leave | Remove or convert their mailbox, so old addresses can't be reused for attacks |
| Yearly | Short refresher for staff on password reuse and phishing |
Do it yourself or get help?
Verifying your domain and running the search takes under an hour if you can add a DNS record. The follow-up, password resets, MFA rollout and a password manager for everyone, is where most small businesses need a hand.
Our Password Manager Rollout (S$290) sets up a business password manager and moves staff off reused passwords. Our Microsoft 365 / Google Security Lockdown (S$590) enforces MFA, sign-in alerts and the settings that stop a leaked password turning into a hacked mailbox.
Frequently asked questions
Check single addresses at haveibeenpwned.com. To see every address on your domain, sign in to the HIBP dashboard, add your domain and verify control with a DNS TXT record, an email to a pre-defined address, a file upload or a meta tag. The domain search then lists each breached address and the breaches it appeared in.
For small domains, yes. HIBP says you can check your domain's breach count free by adding it to your dashboard, and its paid plan limits only count domains with more than 10 breached addresses. Larger domains need a subscription; the entry Core plan was listed at $4.39 a month billed annually in October 2026.
No. It means your address, and possibly a password, was leaked from another site. The risk is that attackers try the same password on your email. If the password was reused, reset it, confirm MFA is on, and check sign-in logs and inbox rules for anything you didn't set up.
Credential stuffing is when attackers take email and password pairs leaked from one breach and try them automatically on other services, such as Microsoft 365, Google, banking or supplier portals. It works because people reuse passwords. Unique passwords from a password manager and MFA on every account are the main defences.
Yes, but HIBP's terms say Core plans are for domains you control yourself and do not permit use on behalf of third parties. Providers monitoring customers' domains need a Pro plan. Alternatively, you verify and keep your own domain in your HIBP dashboard and share alerts with your provider.