Employee Email Breach Monitoring
Know Which Employee Addresses Are in Which Breaches.
Employees sign up for third-party services with their work address. When one of those services is breached, the address leaks with whatever else the service held about it.
The Deepinfo Platform watches breach data for the addresses on your corporate domains. For each address it finds, it records the breaches it appears in and the data types that leaked with it.
- Passwords breach
- Phone numbers breach
- Names, Job titles breach
- new breach, raises new_email_breach_detected
first → last breach date
- Passwords
- Phone numbers
- Names
- Job titles
What Each Breached Account Tells You.
| Email and domain | The address, and which of your corporate domains it belongs to |
|---|---|
| Breaches | The breaches the address appears in, with a breach count |
| Data types | What leaked with it across those breaches: passwords, phone numbers, names, job titles and more |
| First and last breach date | How long the address has been exposed, and how recently |
| Last added date | When a breach containing the address was most recently added |
| Profile | First and last name, job title and a profile URL, editable by your team |
| VIP flag | Marks executives and other high-value accounts so they can be filtered and reviewed first |
Filter and sort on any of these in the platform, or through the Breached Account List endpoint.
Judge Each Breach on Its Context.
A breach count alone says little. Each breach record carries what your team needs to decide whether it matters.
Context
Date, Description, Data Types
When the breach happened, when it was added, what the breached service was and which data types it exposed, with the number of affected accounts.
Quality
Flags That Qualify the Source
Each breach is flagged as verified or fabricated, as a spam list or as coming from malware, and as sensitive or retired. Filter on the flags before you count exposure.
Reach
Your Share of It
How many of your accounts are in the breach, and which of your domains they sit on.
Get Told About New Breaches.
A notification rule on the new_ event emails the team members you choose when a new breach includes one of your addresses. Delivery is instant, hourly, daily, weekly or monthly.
The CTI Email Breach Summary report packages that picture as a PDF, generated on demand or scheduled daily, weekly or monthly.
Everything else is in the API: breached accounts and breaches with filters and ordering, per-account and per-domain statistics, the latest breaches, and profile updates.
curl "https://api.deepinfo.com/v1/cti/email-breaches/accounts?vip=true&ordering=-last_breach_date" \
-H "apikey: YOUR_API_KEY"Query This Data Through the API
Credentials and dark web findings stay in the Deepinfo Platform. The domain and vulnerability data around them is open through the API.
Questions About Employee Email Breach Monitoring
Which addresses does it cover?
The addresses on the corporate email domains in your scope. Breached accounts are grouped by domain, so subsidiaries and regional domains can be reviewed separately.
Does a breached address mean its password leaked?
Not necessarily. Each breach lists the data types it exposed, so check whether passwords were among them before forcing a reset; an address that leaked with a name and a phone number calls for a different response.
Does it cover employees’ personal addresses?
No. A personal address can be checked on demand with Dark Web Search.
How is this different from compromised device monitoring?
A breach exposes what a third-party service stored about an address. An infostealer infection exposes what the employee’s own browser stored: saved logins and session cookies for many services at once. The two call for different responses, so the platform tracks them separately.
Can we get breach data into our own tools?
Yes. The Email Breaches API lists breached accounts and breaches with filters and ordering, returns per-account and per-domain statistics, and updates account profiles. See the CTI reference.
See Which Addresses Are Already in Breaches.
Book a demo and we’ll walk through the breach picture for your corporate domains.