Skip to main content

Data Leak Monitoring

Overview​

Data Leak Monitoring scans for your employees' credentials in data breaches across the dark web and public breach databases. Identify compromised accounts before attackers exploit them.

Why Data Leak Monitoring?​

The Risk​

  • Average person has 100+ online accounts
  • 65% of people reuse passwords
  • Billions of credentials exposed in breaches
  • Compromised credentials are sold and traded

Credential Reuse Impact​

When an employee's personal account is breached:

  1. Attackers try the same password elsewhere
  2. Corporate accounts often share passwords
  3. Credential stuffing attacks are automated
  4. Accounts compromised within hours

How It Works​

Monitoring Process​

  1. Domain Configuration

    Bastion monitors your email domains.

  2. Breach Scanning

    Continuous scanning of breach databases and dark web.

  3. Match Detection

    Employee emails matched against breach data.

  4. Alert Generation

    Alerts created for exposed credentials.

  5. Remediation

    Password reset and employee notification.

Data Sources​

SourceDescription
Breach DatabasesCollections of known breaches
Dark WebCredential marketplaces
Paste SitesData dump websites
Combo ListsCompiled credential lists

Issue Dashboard​

Viewing Issues​

Navigate to Employees → Data Leak → Issues

Each issue shows:

  • Employee email
  • Breach source
  • Date discovered
  • Data exposed (password, hash, personal info)
  • Status (new, in progress, resolved)

Issue Severity​

SeverityMeaning
CriticalPlaintext password exposed
HighWeak hash exposed (likely cracked)
MediumStrong hash exposed
LowEmail only, no password

Issue Details​

Click an issue to see:

  • Breach Information - Name, date, scope
  • Exposed Data - What was leaked
  • Employee History - Past breaches for this employee
  • Recommended Actions - Remediation steps

Remediation Workflow​

Handling Issues​

  1. Review

    Review issue details and severity.

  2. Notify

    Notify the affected employee.

  3. Password Reset

    Require password reset on corporate accounts.

  4. Verify

    Confirm password was changed.

  5. Close

    Mark issue as resolved.

Notification Options​

MethodConfiguration
EmailSend breach notification email
In-AppNotify within Bastion
ManualHandle notification yourself

Email Template​

Customize the breach notification email:

  • Subject line
  • Breach details to include
  • Required actions
  • Links to password reset

Integration with Identity​

Forced Password Reset​

With identity provider integration:

  1. Issue detected
  2. Automatic forced password reset triggered
  3. Employee must reset on next login
  4. Reset verified in Bastion

Supported Integrations​

  • Azure Active Directory
  • Google Workspace

Historical Data​

Breach History​

View historical breach data:

  • Total breaches affecting organization
  • Trend over time
  • Most affected employees
  • Common breach sources

Employee Breach History​

Per employee:

  • All past breaches
  • Credentials exposed
  • Remediation status
  • Risk level

Proactive Measures​

Password Policies​

Reduce breach impact with:

  • Unique passwords per account
  • Password manager usage
  • MFA enforcement
  • Regular password rotation

Training Integration​

Link to awareness training:

  • Password security courses
  • Post-breach training assignment
  • Credential hygiene education

Reporting​

Breach Reports​

Generate reports showing:

  • Summary - Total breaches, affected employees
  • Trend - Breaches over time
  • By Department - Department breakdown
  • Remediation Status - Open vs. resolved

Compliance Evidence​

Breach monitoring supports:

FrameworkRequirement
SOC 2CC6.8
ISO 27001A.12.6.1

Alerts Configuration​

Alert Settings​

Configure how you're notified:

SettingOptions
FrequencyReal-time, daily digest, weekly
RecipientsSecurity team, employee managers
Severity FilterAll, high and above, critical only

Escalation​

Set up escalation for unresolved issues:

  1. Initial alert to security team
  2. 24 hours: reminder to security team
  3. 48 hours: escalate to manager
  4. 72 hours: escalate to CISO

Best Practices​

Act Quickly

Breached credentials are often exploited within hours. Fast remediation is critical.

Monitor Personal Domains

Consider monitoring common personal email domains if they're used for business tools.

Enforce MFA

MFA reduces breach impact significantly. Even with stolen passwords, accounts remain protected.

Educate Employees

Train employees on password hygiene and the risks of credential reuse.

Next Steps​

People

Manage employee directory

Training

Assign password security training