Password Leaks

What is a Password Leak?

A Password Leak means Microsoft detected that a user's credentials were exposed in a third-party data breach or found circulating on the dark web. This is not a successful account compromise. The attacker has the user's password, but there is no evidence they have successfully logged into the account.

How Password Leaks Differ from Account Compromises

It is important to understand the distinction between a Password Leak and an Account Compromise (incident):

• Password Leak: Credentials were exposed. The attacker *may* attempt to log in, but has not done so successfully. No alert is generated.

• Account Compromise: An attacker successfully authenticated to the account. Petra publishes an incident and notifies your team.

Password Leaks occur roughly 5x more frequently than Account Compromises. Having a leaked password does not reliably predict that a compromise will follow; attackers use automated toolkits that cycle through leaked credentials across many targets, so a user may appear in multiple leaks without ever being successfully compromised.

Why Password Leaks Still Matter

Even though most Password Leaks do not lead directly to a compromise, they are a meaningful risk signal:

• Increased targeting: Users with a leaked password are targeted far more frequently than users whose credentials are not in circulation. Attackers actively reuse and resell leaked credential lists.

• Toolkit-based re-compromise: Automated attack toolkits continuously retry leaked credentials. A user who has been leaked once will often appear in future leaks as well — this is a sign of ongoing exposure, not necessarily a new breach.

• Easy, high-value remediation: A password reset is low effort and directly eliminates the risk. Resetting the password makes the leaked credential worthless to any attacker who holds it.

Recommended Action: Reset the Password

The only remediation for a Password Leak is to reset the affected user's password. Petra makes this straightforward:

1. Open the Password Leak detail page for the affected user.

2. Click Reset Password in the Remediation Actions section.

3. Optionally check Force password change on next sign-in to require the user to set a new password themselves at their next login.

4. Petra will reset the password via Microsoft and record the action, marking the leak as resolved.

Once the password is reset, the leak status updates to Password Reset and no further action is needed.

Frequently Asked Questions

Does a Password Leak mean the user was hacked?

No. A Password Leak means the user's credentials were found outside of Microsoft systems — for example, in a breach of an unrelated service where the user reused their password. Microsoft flagged the credentials as compromised, but there is no sign of a successful login to the Microsoft 365 account. If an attacker had successfully logged in, Petra would have published an incident, not a leak.

Why do some users have multiple Password Leaks?

Leaked credentials are widely shared and resold among attackers. Automated toolkits continuously retry these credentials, which can trigger repeated detections for the same user. This does not mean the user has been compromised multiple times — it means their credentials remain in active circulation. Resetting the password after each detection is the right response.

Will Petra alert my team about a Password Leak?

No. Password Leaks do not generate alerts or notifications. They appear in the Password Leaks section of the Petra dashboard for your team to review and act on at their discretion. If an actual account compromise is detected, Petra will publish a separate incident and notify your team through the normal alert channels.

What if the password was already reset before Petra detected the leak?

Petra checks whether the user's password was reset after the leak event. If it was, the leak will automatically be marked as Password Reset without requiring any additional action.