Skip to content
Datalogia

Companies·Surface 01

Exposed employee data

Your staff's work emails, passwords and tokens circulate in leaks and on resale forums. Every exposed credential is a direct way into your information system.

Request the first auditThe four surfaces

Excerpt from a report, fictitious data
AddressSourceSeverity
m.dupont@company.comLinkedIn 2021High
t.bernard@company.comFree 2024High
a.martin@company.comCollection #1Medium
c.durand@company.comStealer logsCritical
Plain-text password in the last row: rotate immediately.

What is exposed

Leak databases hold your teams' most sensitive data: work email addresses (first.last@company.com), plain-text or hashed passwords, access tokens to internal tools (Slack, Notion, Jira, GitHub), HR numbers, and sometimes identity documents. This information is resold or published on specialised forums.

Where these leaks come from

The 2021 LinkedIn leak exposed more than 700 million profiles. Free, in 2024, put 19 million French identities into circulation. Third-party SaaS tools (Trello, HR tools, online forms) often share data without companies knowing. One employee signed up on an outside forum with a work address is enough to feed these databases.

The risks: credential stuffing, wire fraud, targeted phishing

Once exposed, these credentials feed automated attacks: mass testing against your systems, wire fraud by impersonating an internal address, tailor-made phishing. In 2023, business email compromise cost $2.9 billion according to the FBI. A single compromised account can be enough to take over the information system.

What we do

We look for each of your staff's email addresses in the known leak databases. Each result is sourced and rated by severity. An alert goes out as soon as a new exposure is detected, and removal requests are sent to the sources concerned.

How we step in

  1. Step 01
    The report

    We map the exposure of all your email domains across the known leak databases.

  2. Step 02
    Analysis and alerts

    Each exposed credential is assessed: source, age, severity. You receive a detailed report.

  3. Step 03
    Removals and watch

    We send the removal requests, then check every week whether anything reappears.

Are your employees exposed?

A report on the exposure of your email domains, free for the first audit.

Request the first auditSee the tiers