The breach that matters most to your organisation may not be one that happened to you. It may be a breach that happened to LinkedIn. Or Adobe. Or Canva. Or any of the dozens of platforms your staff use with their work email addresses and passwords they reuse across multiple accounts.
When those platforms are compromised — and they are compromised regularly, at scale, with minimal public acknowledgment and even less organisational notification — the credentials your staff entered are extracted, compiled, and sold on criminal marketplaces. They sit there, available to anyone willing to pay a modest fee, waiting to be used against the organisations those email addresses belong to.
They may have been sitting there for months. Or years. And unless your organisation has specifically checked, you have no idea whether they are there or not.
What You Need to Understand
- Credential exposure from third-party breaches is one of the most common initial access vectors in attacks on Australian organisations
- Stolen credentials are sold and resold through criminal markets — a single set of credentials may be attempted against your systems years after the original breach
- Password reuse means that credentials stolen from one platform frequently work on others — including corporate email, VPNs, and cloud platforms
- Most organisations have never checked whether their domain appears in breach intelligence databases — and many have multiple current exposures
- A single valid credential in the hands of a motivated attacker is sufficient to initiate a compromise that takes months to detect and years to fully remediate
How Credential Exposure Works
Every time a staff member registers for a platform using their work email address, they create a link between your organisation and that platform’s security posture. If the platform is breached — and the probability that at least some of the platforms your staff use will experience a breach over a five-year period is very high — the credentials they registered with enter the breach ecosystem.
Breach data is aggregated into databases that are traded on criminal forums and marketplaces. The aggregation is sophisticated: stolen credentials from dozens of separate breaches are combined, deduplicated, and enriched with additional data about the individuals involved. The result is a dataset that, for any given organisation, tells a threat actor which email addresses are active, what passwords have been used historically, and which platforms those credentials were associated with.
This intelligence is used in two primary ways. The first is direct credential stuffing — attempting the known username and password combination against corporate systems in the hope that the password has been reused. The second is targeted phishing — using knowledge of which platforms a staff member uses to craft a convincing impersonation that prompts them to enter their current credentials into an attacker-controlled page.
In both cases, the starting point is data that is already publicly available to anyone who knows where to look. The breach happened somewhere else. The exploit happens to you.
What Happens After a Credential Is Compromised
The timeline between credential exposure and active exploitation is not predictable. Some credentials are attempted within days of being listed for sale. Others sit unused in databases for years before a threat actor with a specific target purchases and deploys them. The uncertainty itself is the risk — there is no point at which an organisation can assume that an exposed credential has passed its useful life for an attacker.
The third-party platform is breached. A SaaS vendor, a professional network, a subscription service used by one of your staff is compromised. The breach may not be publicly disclosed for weeks or months. Your organisation receives no notification.
Credentials appear in criminal markets. The stolen data is processed, compiled, and listed for sale. Your staff member’s work email address and their password for that platform are now available to purchase. Automated tools begin testing these credentials against common corporate login pages.
A targeted actor purchases the dataset. Someone with a specific interest in organisations like yours buys the compiled credential database. They identify email addresses associated with your domain. They begin systematic testing against your corporate systems — email, VPN, cloud storage, financial platforms.
A credential works. The password was reused, or a variation of it was predictable enough to break. The attacker is inside. They move quietly — reading emails, mapping systems, identifying financial processes and client relationships. They are in no hurry. The average dwell time before detection is over 200 days.
The attacker acts. Armed with months of intelligence about your organisation, they initiate the fraud, the data theft, or the ransomware deployment they have been building toward. By the time it is detected, the preparation is complete and the outcome is largely determined.
The Scale of the Problem in Australia
Australian organisations are disproportionately represented in breach intelligence databases relative to their size in the global economy. Several factors contribute to this. The high adoption of cloud-based platforms and SaaS tools increases the surface area of third-party credential exposure. The relatively high average income and developed financial system make Australian organisations attractive targets for financially motivated threat actors. And the historically lower investment in security monitoring and threat intelligence means that exposures persist longer before being detected and addressed.
The ACSC’s annual threat reports have consistently identified compromised credentials as one of the top initial access vectors in attacks on Australian organisations across every sector. It is not a sophisticated attack vector. It requires no technical capability beyond the ability to purchase a dataset and run automated testing tools. The barrier to entry for this category of attack is lower than almost any other — and it is effective precisely because most organisations have never assessed their own credential exposure.
What a Breach Intelligence Assessment Reveals
A structured breach intelligence assessment examines your domain against aggregated breach databases to identify which email addresses associated with your organisation have appeared in known breach datasets, what platforms those breaches originated from, how recently the exposure occurred, and whether the associated passwords are of a type that is likely to have been reused across multiple platforms.
The findings are rarely reassuring. Organisations that have never conducted this assessment almost always have at least one current exposure, and frequently have multiple. The exposures span a range of platforms — professional networks, subscription services, industry forums — and the affected email addresses are often those of senior staff whose accounts represent the highest-value targets for an attacker seeking access to privileged systems and sensitive information.
What the assessment does not do is tell you whether an attacker has already acted on that exposure. The credential data is available. Whether it has been purchased and used is not visible from the outside. That uncertainty is precisely why the assessment matters — because it is the first step in a response process that, if initiated before an incident, substantially reduces both the probability and the impact of exploitation.
The Silence That Is Not Reassurance
The most dangerous assumption an organisation can make about credential exposure is that the absence of a known incident means the absence of a problem. Breach data circulates through criminal ecosystems for years. The fact that your organisation has not experienced a credential-based compromise that you are aware of does not mean that your credentials are not already in circulation, already purchased, or already being tested.
The dwell time statistics are the clearest expression of this dynamic. More than 200 days pass, on average, between the moment an attacker gains access to an organisation and the moment that access is detected. In that period, the organisation believes it is secure. The incident investigation that follows will almost always find the initial access vector — and it is frequently a credential that appeared in a breach database months or years before the organisation knew anything was wrong.
Knowing your credential exposure before an attacker acts on it is not a guarantee of safety. It is an opportunity to respond on your terms rather than theirs. That opportunity is available to every organisation willing to look. Most have not looked. The question is whether you are one of them.