Password Leaks and Credential Compromise

Password leaks and credential compromise

Sometimes user credentials—passwords or related secrets—are exposed in a breach or leak outside your organization (for example, on the dark web or in a public dump). Microsoft and other sources can detect when a user's credentials have been leaked and signal that the account may be at risk. Petra can surface these as "password leak" events so you can take action, such as requiring a password reset. This article explains what password leaks are in Petra and how to respond.

What a password leak event is

A password leak (or credential compromise) in Petra is a finding that a user's credentials have been detected in a leak or breach—meaning the password or related secret may be in the hands of attackers. These events are often driven by Microsoft's detection of leaked credentials or by other threat intelligence. Petra creates a record for the leak, ties it to the affected user (identity) and tenant, and may suggest or let you take remediation actions such as resetting the password so the compromised credential no longer works.

What you'll see

Password leak events typically appear in a dedicated area (e.g., a password leaks list or section) so you can see all users in your tenant(s) who have been flagged. You can open an event to see which user is affected, when the leak was detected, and what actions have been taken. You may see options to reset the password for the user (if remediation is enabled) or to mark the event as handled. Keeping track of password leaks helps you ensure that every exposed credential gets a password reset and that users are notified when appropriate.

Why you should act

Leaked credentials are a direct risk: attackers can use them to sign in as the user until the password is changed. Resetting the password invalidates the leaked credential and forces the user to set a new one. You may also want to notify the user so they know why they had to reset and can avoid reusing the same password elsewhere. Treat password leak events as high priority and clear them by resetting the password and, if needed, confirming the user has signed in successfully with the new password.