What to do when an executive's password is in a breach

The checklist at a glance

Read the finding before you act

A breach finding is a record that a service lost data containing the executive's credentials. Before changing anything, read four things from it.

1. Which address. A corporate address points at company accounts. A personal address points at the executive's private accounts, which the company does not control. The guide to executive personal accounts covers that case.
2. Which service and when. A breach from last year is more urgent than one from a decade ago, because the password is more likely to still be in use.
3. What form the password is in. A plaintext password can be used immediately. A hashed password has to be cracked first, which is quick for weak passwords and slow for strong ones.
4. Whether it repeats. The same password in several breaches is a strong sign of password reuse, and reuse is what turns a breach at a shopping site into a risk for the corporate mailbox.

An old record does not prove the password still works. It proves that the password was exposed and that attackers may have it.

In the first 24 hours

1. Talk to the executive privately. Ask whether the leaked password, or a close variant of it, is still used anywhere: corporate sign-in, personal email, banking, or as the master password of a password manager. Keep this conversation out of a shared ticket queue.
2. Change the password everywhere it was used. NIST's digital identity guidelines, SP 800-63B, say verifiers shall not require periodic password changes, but shall force a change if there is evidence that the authenticator has been compromised. A password in a breach is that evidence. Each new password should be unique, which in practice means a password manager.
3. Sign out active sessions. A new password does not necessarily end sessions that are already open. For Microsoft Entra ID, Microsoft's guidance for revoking access uses the Revoke sessions action in the admin center, or Revoke-MgUserSignInSession in PowerShell. Microsoft notes that access tokens last one hour by default, and that Entra ID cannot directly revoke a session token issued by an application, so applications with their own sessions need their own sign out. For a personal Google account, Google's device page lists where the account is signed in and lets the owner sign out each device.
4. Check recent sign-ins. Look at the corporate account's sign-in history since the breach date for unfamiliar locations, devices or new mailbox rules. Ask the executive to do the same on personal email.
5. Check that multi-factor authentication is on. Any second factor is better than none while the stronger setup is prepared.
6. Warn the people around the executive. Assistants and finance approvers are the people a fraudster contacts in the executive's name. Tell them to expect unusual payment or access requests that appear to come from the executive. The article on CEO fraud and BEC explains how leaked fields make those requests convincing.

Within 7 days

Move to phishing-resistant authentication. CISA's fact sheet on implementing phishing-resistant MFA says that any form of MFA is better than none, but that phishing-resistant MFA is the gold standard, and it urges system administrators and other high-value targets to implement or plan their migration to it. CISA calls FIDO/WebAuthn the only widely available phishing-resistant authentication. It also lists the weaknesses of the alternatives: codes sent by text message are exposed to SIM swap and SS7 attacks, and app codes and push prompts can still be phished. Passkeys are built on FIDO standards, and Google's passkey documentation explains that because they are bound to a website or app's identity, they resist phishing. Start with the executive's corporate email and single sign-on, then their personal email.

Review account recovery. Check the recovery email address and phone number on the corporate account and on the executive's main personal accounts. An old personal address that can reset a current account is a weak point, especially if that old address also appears in breach data.

Block the leaked password. NIST SP 800-63B requires that new passwords be compared against a blocklist, and gives passwords obtained from previous breach corpuses as an example of what belongs on it. Make sure the leaked password, and obvious variants, cannot be set again on corporate systems.

Check the rest of leadership. A breach that exposed one executive can also have exposed colleagues who used the same service. Run the same check for the leadership team rather than treating the finding as a single case.

Within 30 days

Write down what happened. Record what was found, which accounts were changed, which sessions were revoked, which authentication methods were upgraded and who approved each step. That record helps the security team, and it answers the later question of what leadership knew and when. For how management bodies can document credential risk under EU rules, see the article on NIS2 Article 20. This section is general information and not legal advice.

Decide when to check again. New breaches keep surfacing, and old ones get reposted in new lists. Agree internally how often leadership is checked against breach data, and name the owner.

Separate personal and work credentials. Ask leaders not to register personal services with corporate addresses and not to use the same password across personal and work accounts.

Self-check: is your CEO in a breach

For a single address, Have I Been Pwned is a free starting point. On October 2, 2026 its home page listed 17,837,635,527 pwned addresses across 1,039 pwned websites. A search returns the breaches an address appeared in. The site's FAQ states that no password is stored next to any personally identifiable data such as an email address, so the search does not show the password itself.

To check a password without sending it, the Pwned Passwords service hashes it locally and sends only the first five characters of the SHA-1 hash. Have I Been Pwned advises that a pwned password should no longer be used.

A self-check covers one address at a time, and only addresses you already know. For the leadership team, WebThreat's CEM starts from the company name, discovers the executives and checks each one against breach corpora and leak databases. Findings are ranked by what to fix first, and the factors are on the methodology page.

What a breach record cannot tell you

A breach record shows that a credential leaked from a service. It does not show:

• whether the executive's device is infected with an infostealer, which can also take browser session cookies;
• whether an attacker has already signed in with the leaked password;
• whether the password still works today.

CEM shows which credentials appear in breach data and ranks what to reset first. Stealer logs, which can carry browser sessions (session cookie theft), are traded in the channels and communities that EDG3 watches, including dark web forums and Telegram. If you suspect an infected device or a hijacked session, treat it as an incident and bring in incident response.