What to do when an employee’s work email appears in a breach
2 min read · Updated November 8, 2026
If an employee’s work email shows up in a breach, find out which service leaked it and what data was exposed, reset the employee’s password and sessions, check that two-factor authentication is on, review recent sign-ins and warn the team about related phishing.
First, understand the match
Identify which service was breached and whether passwords were part of the data. A match on a marketing platform with only emails exposed is different from one that included passwords the person reuses at work.
Immediate actions
- ✓Reset the employee’s password and sign out active sessions.
- ✓Confirm two-factor authentication is enabled on email and key tools.
- ✓Review recent sign-in activity and mailbox rules for anything unusual.
- ✓Ask whether the same password was used elsewhere, and change it there too.
See how exposed your team’s email is
Leaked work emails fuel phishing and account takeover. Review your company’s exposure with a corporate audit.
Protect the rest of the company
- ✓Warn staff about phishing that mentions the breached service.
- ✓Check whether other employees used the same service with work addresses.
- ✓Tighten policy so work emails are not used for non-business sign-ups.
Record it and learn from it
Keep a short note of what was found and what was done. If the match involved a customer-facing or regulated system, check whether you have any notification duties.
Frequently asked questions
Do we need to tell customers?+
Only if customer data was involved in a breach of your own systems. A third-party breach of an employee’s sign-up usually does not require customer notice, but check your obligations.
Can we block leaked passwords?+
Many identity providers can check passwords against known breached lists and reject them.
Is it the employee’s fault?+
Usually not. Third-party breaches happen to everyone, and the goal is to limit the impact.
Stop guessing. Check your email in seconds.
The Leakill scan looks for your email address in known breach records and delivers a detailed report: the incidents, dates, sources, the kinds of data involved and practical next steps. It is a one-time $1.99 payment, not a subscription.
A breach match is a warning signal, not proof that someone has access to your account today. No public database covers every breach, so a clean result lowers risk without guaranteeing safety.