Last week we hosted a webinar with our security partner VigilAiGent called What the Dark Web Knows About Your Business. Near the end I asked Matt Bergeron, VigilAiGent’s Field CISO, the question I hear most from business owners: “If I find out tonight that one of my passwords is out there, what do I do first?”
His answer was simple: act right away, and don’t stop at the one account. Here’s that advice turned into a checklist you can follow in the first hour, written for a small office without a full-time IT department.
First, how did my password get there?
Most of the time it wasn’t your fault. Logins end up for sale in a few common ways:
- Someone else got breached. A shopping site, a vendor portal or an app you signed up for years ago lost its user database. If you used your work email there, your login is now on a list.
- Phishing. A fake Microsoft or Google sign-in page, or an email that looks like it came from your boss or a vendor. (If this one already happened, start with our 5-step guide for when an employee clicks a phishing link.)
- Malware. A “free” tool or browser extension that quietly copies saved passwords.
- Password reuse. One password used in five places means one breach unlocks all five.
Criminals collect these logins, package them by the thousands, and sell them. The buyer doesn’t need to “hack” anything. They just try to log in.
The first hour: 6 steps
1. Change the exposed password, and every place you reused it
This is the step people skip. Changing the one account isn’t enough if the same password (or a close cousin of it) also opens your email, your bank or your accounting software. Matt put it this way: go into your financial accounts and your business admin portals and make sure that password isn’t used anywhere else. Start with the accounts that can do the most damage:
- Your business email (Microsoft 365 or Google Workspace)
- Online banking and payroll
- Accounting and tax software
- Any admin account for your website, domain or firewall
Make every new password unique. A password manager makes this painless.
2. Sign out of every session
A new password doesn’t always kick out someone who’s already logged in. In Microsoft 365 and Google, you can sign out of all sessions from your account’s security settings. If you’re not sure where that is, this is a good moment to call your IT provider.
3. Check your multi-factor authentication
Make sure MFA is turned on, and look at the methods listed. If you see a phone number or authenticator app you don’t recognize, remove it and tell your IT team. Attackers who get in often add their own MFA method so they can come back later.
4. Look for email forwarding and inbox rules
This is a favorite trick. An attacker sets up a quiet rule that forwards your mail to an outside address, or moves anything with “invoice” or “payment” in the subject to a folder you never open. Check your mail settings for forwarding and for rules you didn’t create.
5. Call your IT and security partner
They can check sign-in history for logins from places you’ve never been, lock down the device if needed, and make sure the problem hasn’t spread to other users. Our security operations center at VigilAiGent watches for exactly this, around the clock. A recent example: a client logged in from Canada while traveling, and the system flagged it within minutes so we could confirm it was really them.
6. If money is involved, call the bank
If the exposed login touches banking, payroll or payment systems, call your bank directly (use the number on their website, not one in an email). Then let your team know to double-check any request to change payment details, by phone.
What not to do
- Don’t wait because “it’s an old password.” Old passwords tend to look a lot like new ones.
- Don’t email or text the new password to anyone, including IT.
- Don’t assume it was only one account. Check the others.
The next week: make a stolen password useless
Here’s the bigger lesson from the webinar. Your password will probably leak at some point, through no fault of your own. Matt said his own information is on the dark web, and most of ours are too. The goal is to make a stolen password not enough to get in.
When I asked Matt for the one control he’d pick for a small office of 10 to 30 people, he chose secure access: setting things up so your accounts only accept a login from you, on your device. With that in place, someone holding your password in another country still can’t get in. Pair that with:
- A password manager and unique passwords for every account
- MFA on email, banking and anything with client data
- Email security that catches the phishing messages before anyone clicks
- Endpoint protection on every computer
Our cyber hygiene tips cover the day-to-day habits, and if you’ve already been part of a breach notice, see what to do if your data was leaked.
Watch the full webinar
The 25-minute replay covers how logins end up for sale, what criminals do with them and the tools that stop them, all in plain English. Watch the replay here.
Find out what’s already out there
Not sure if your business logins are exposed? We’re offering a free External Attack Surface Risk Assessment. Together with VigilAiGent, we look at your business from the outside, the same way an attacker would, including leaked logins tied to your domain. Then I sit down with you, walk through the results and give you a short list of what to fix first.
All we need is your domain name. Reserve your assessment or call us at (410) 219-2695.
