OSINT

Our OSINT investigations over the past year have uncovered an alarming reality: login credentials from your employees are being traded, shared, and weaponized across the dark web and public breach databases. And most organizations have no idea it’s happening. 

We analyzed credential leaks across client companies through comprehensive open-source intelligence investigations—monitoring public data breaches, dark web marketplaces, credential stuffing databases, and compromised service repositories. The findings demand immediate action. 

Credential Leak Statistics 

 

Leaked Credentials Distribution Across Client Organizations 

The scale of credential exposure is staggering and highly variable: 

• Average per organization: 68 leaked credentials— this is per company, not per employee
• Highest observed: 282 credentials— one client had nearly 300 exposed account pairs
• Lowest observed: 1 credential— but this represents a missed detection, not a small problem

What does this mean? Even “small” numbers of leaked credentials represent direct footholds into your network. A single compromised admin account or shared service credential can unlock your entire infrastructure. 

 

The Attack Chain: How It Unfolds 

Step 1: Credential Acquisition 

Your employee’s password is compromised through: 

• Third-party service breach (they reused their password across multiple websites)
• Phishing email capturing credentials
• Data broker selling credentials from previous breaches
• Public GitHub commits containing API keys or service accounts

Step 2: Credential Testing 

Attackers test credentials against common targets: 

• Corporate email (Office 365, Google Workspace)
• VPN access
• SSH services
• Cloud platforms (AWS, Azure, GCP)

Step 3: Device Compromise 

Once inside, malware is deployed: 

• Keyloggers capturing additional credentials
• Session hijacking stealing active tokens
• Persistence mechanisms ensuring continued access

Step 4: Lateral Movement & Reconnaissance 

From the compromised device, attackers: 

• Map the network
• Identify high-value targets (finance, HR, R&D)
• Harvest domain admin credentials
• Compromise backup systems

Step 5: Ransomware Deployment or Data Exfiltration 

The endgame—either encrypting everything or stealing everything (or both). 

 

Immediate Actions Required 

Priority 1: Multi-Factor Authentication (MFA) Everywhere 

Why: MFA blocks unauthorized access even when passwords are stolen. This is the single most effective mitigation.

• Enforce MFA on all email and VPN access (non-negotiable) 
• Extend to cloud platforms (AWS, Azure, GitHub) 
• Use authenticator apps or hardware security keys, not SMS when possible 
• Effect: Stolen credentials become 99% useless 

Priority 2: Proactive Breach Monitoring 

Start Today: 

• Set up dark web monitoring for your domain, company names, and key infrastructure 
• Automate credential checking against known breach databases 
• Trigger immediate password resets when matches are found 
• Effect: Detect compromises within hours, not months 

Priority 3: Strong, Unique Passwords via Password Managers 

Policy Requirements: 

• Mandatory password manager deployment (Bitwarden, 1Password, Dashlane) 
• Minimum 16-character randomly generated passwords 
• Unique passwords per service (eliminates password reuse attacks) 
• Quarterly audits of weak or reused passwords 
• Effect: Compromises at one service don’t cascade to others 

Priority 4: Shift Toward Passwordless Authentication 

For High-Risk Accounts: 

• Implement passkeys (FIDO2) for email and VPN access 
• Use biometric authentication on endpoints 
• Deploy Windows Hello for Business (Windows devices) 
• Target: Eliminate passwords for admin accounts, finance, HR, executives 
• Effect: Credentials can’t be stolen if they don’t exist 

Priority 5: Employee Training & Quarterly Account Audits 

Ongoing Discipline: 

• Annual security awareness training focused on phishing and credential hygiene 
• Quarterly reviews of active employee accounts—disable unused access 
• Incident response drills simulating credential compromise scenarios 
• Effect: Reduces attack surface and catches insider threats early

 

The OSINT Visibility Gap 

The terrifying part: Most organizations discovered their credential leaks through our OSINT investigations, not through their own security tools. 

This reveals a critical blind spot: 

• Passive Defense: Your organization monitors what’s inside your network 
• Active Threats: Attackers operate in databases, dark web forums, breach repositories outside your visibility 
• The Gap: You don’t know your credentials are compromised until attackers start using them 

OSINT flips this script—you discover threats before they reach your network. 

Risk Quantification 

Consider this scenario (not uncommon based on our investigations): 

• 68 leaked credentials = 68 different attack vectors 
• 1-3 compromised devices = trusted insider access 
• No MFA = attackers walk through your front door 
• No breach monitoring = you discover the problem when ransomware deploys 

Outcome: Full network encryption, data theft, business disruption, regulatory fines, reputation damage.  **\

Key Takeaway 

Credential leaks aren’t an “if”—they’re a “when”. Your employees’ passwords are likely already on the dark web. The question is: How quickly will you know, and how effectively will you prevent attackers from using those credentials? 

Organizations that invest in MFA, breach monitoring, and device health now avoid the ransomware conversation later.