# Employee Email Breach Monitoring URL: https://www.deepinfo.com/platform/cti/employee-email-breach-monitoring/ ## Know Which Employee Addresses Are in Which Breaches. Employees sign up for third-party services with their work address. When one of those services is breached, the address leaks with whatever else the service held about it. The Deepinfo Platform watches breach data for the addresses on your corporate domains. For each address it finds, it records the breaches it appears in and the data types that leaked with it. [Request demo](https://www.deepinfo.com/request-demo/) ### What Each Breached Account Tells You. - **Email and domain**: The address, and which of your corporate domains it belongs to - **Breaches**: The breaches the address appears in, with a breach count - **Data types**: What leaked with it across those breaches: passwords, phone numbers, names, job titles and more - **First and last breach date**: How long the address has been exposed, and how recently - **Last added date**: When a breach containing the address was most recently added - **Profile**: First and last name, job title and a profile URL, editable by your team - **VIP flag**: Marks executives and other high-value accounts so they can be filtered and reviewed first Filter and sort on any of these in the platform, or through the [Breached Account List](https://docs.deepinfo.com/reference/cti/breached-account-list/) endpoint. ### Judge Each Breach on Its Context. A breach count alone says little. Each breach record carries what your team needs to decide whether it matters. Context #### Date, Description, Data Types When the breach happened, when it was added, what the breached service was and which data types it exposed, with the number of affected accounts. Quality #### Flags That Qualify the Source Each breach is flagged as verified or fabricated, as a spam list or as coming from malware, and as sensitive or retired. Filter on the flags before you count exposure. Reach #### Your Share of It How many of your accounts are in the breach, and which of your domains they sit on. ### Get Told About New Breaches. A notification rule on the `new_email_breach_detected` event emails the team members you choose when a new breach includes one of your addresses. Delivery is instant, hourly, daily, weekly or monthly. The CTI Email Breach Summary report packages that picture as a PDF, generated on demand or scheduled daily, weekly or monthly. Everything else is in the API: breached accounts and breaches with filters and ordering, per-account and per-domain statistics, the latest breaches, and profile updates. [CTI API reference](https://docs.deepinfo.com/reference/cti/) VIP accounts, most recent breach first ```bash curl "https://api.deepinfo.com/v1/cti/email-breaches/accounts?vip=true&ordering=-last_breach_date" \ -H "apikey: YOUR_API_KEY" ``` ### Other Ways Credentials Leak. A breached address is one kind of exposure. These are the others. - [Compromised Employee Device Monitoring](https://www.deepinfo.com/platform/cti/compromised-employee-device-monitoring/) (CTI): An infected laptop leaks every login and session cookie its browser kept. - [Compromised Client Credential Monitoring](https://www.deepinfo.com/platform/cti/compromised-client-credential-monitoring/) (CTI): Your customers’ logins to your services, found in leaked data. - [Data Breach Index](https://www.deepinfo.com/platform/cti/data-breach-index/) (CTI): The breaches themselves, with their dates and exposed data types. ### Query This Data Through the API Credentials and dark web findings stay in the Deepinfo Platform. The domain and vulnerability data around them is open through the API. - [Vulnerability Search API](https://www.deepinfo.com/data-api/apis/vulnerability-search/) - [Vulnerability Detail API](https://www.deepinfo.com/data-api/apis/vulnerability-detail/) - [Domain Detail API](https://www.deepinfo.com/data-api/apis/domain-detail/) - [WHOIS History API](https://www.deepinfo.com/data-api/apis/whois-history/) ### Questions About Employee Email Breach Monitoring **Which addresses does it cover?** The addresses on the corporate email domains in your scope. Breached accounts are grouped by domain, so subsidiaries and regional domains can be reviewed separately. **Does a breached address mean its password leaked?** Not necessarily. Each breach lists the data types it exposed, so check whether passwords were among them before forcing a reset; an address that leaked with a name and a phone number calls for a different response. **Does it cover employees’ personal addresses?** No. A personal address can be checked on demand with [Dark Web Search](https://www.deepinfo.com/platform/cti/dark-web-search/). **How is this different from compromised device monitoring?** A breach exposes what a third-party service stored about an address. An infostealer infection exposes what the employee’s own browser stored: saved logins and session cookies for many services at once. The two call for different responses, so the platform tracks them separately. **Can we get breach data into our own tools?** Yes. The Email Breaches API lists breached accounts and breaches with filters and ordering, returns per-account and per-domain statistics, and updates account profiles. See the [CTI reference](https://docs.deepinfo.com/reference/cti/). ### See Which Addresses Are Already in Breaches. Book a demo and we’ll walk through the breach picture for your corporate domains. [Request demo](https://www.deepinfo.com/request-demo/)