Incident Guide
How to Respond to Leaked Credentials
A leaked credential is a live security event. Response quality depends on speed, scope control, and identity hardening.
Immediate Actions (First Hour)
- Force password reset and revoke active sessions.
- Rotate tokens, API keys, and app passwords where relevant.
- Apply MFA reset and high-risk sign-in controls.
- Prioritise privileged and shared account containment.
Investigation Checklist
- Correlate sign-in telemetry for anomalous geos/devices.
- Review mailbox rules and persistence artefacts.
- Assess lateral movement through SSO-connected services.
- Document impact for legal/compliance reporting paths.
Stabilisation Plan (First 72 Hours)
0-24 Hours
Contain identity risk, isolate privileged access, and document incident scope.
24-48 Hours
Complete forensic review, close persistence paths, and harden controls.
48-72 Hours
Implement long-term guardrails and monitoring for recurrence signals.