Find out whether your organization's email addresses have appeared in a known data breach. This takes ten minutes, costs nothing, and does not require logging in to anything. It is the Saturday task for Security Month week three.
Why it matters: when a service you once signed up for is breached, the leaked email addresses and passwords get fed into every login page on the internet within days. A leaked password is only dangerous where it was reused, so the breach check is really a reuse check. Most long-lived addresses show at least one breach; that is normal and not your fault. The hit you find is usually years old, which tells you how long that password may have been circulating. The point of today is not to be alarmed by the list but to close the handful of doors the list points to.
Do this
Go to haveibeenpwned.com.
Enter the organization's main addresses one at a time: your own work address, the role-based ones (info@, webadmin@, donations@), and any address that owns the website, domain, or hosting account.
For each hit, write down the breached service and the year. You are not looking for panic; you are looking for a list.
For every hit, ask one question: was that password ever used anywhere else? If yes, or if you are not sure, change it on the email account, the hosting account, and the registrar first, using a fresh password generated by your password manager.
Turn on two-factor authentication (2FA) for any of those accounts that still lacks it. A leaked password against a 2FA door is a non-event.
Done looks like a short dated list of every organizational address you checked, any breaches found, and a checkmark beside each password rotated.
Get the sampler. If one of today's checks turns out to be the beginning of an actual incident, the Web Emergency Playbook's free "Someone Clicked the Link" sampler walks through the first fifteen minutes. Download the Playbook today, and get next Saturday's quick win with the weekly Web Managers letter at https://webmanagers.com/register.