An indication is not an incident
A business address in a third-party record, an old account entry and a credible signal involving an active identity are different situations. They should not automatically produce the same alert or response.
Have I Been Pwned describes incomplete coverage and retains historical entries after password changes. No match does not establish safety; a match does not prove that credentials still work. [1]
Record three dates
We recommend separating the underlying event date, first observation and latest review. Information first noticed today may concern an old event. Newly discovered and newly compromised are different claims.
Unknown dates should remain unknown. Repeated publication should not silently become several new incidents. Recording these distinctions makes the report easier to act on.
Attribution comes first
Establish whether the evidence connects a domain, a specific identity, a service or merely a similar business name. An alarming score is no substitute for that explanation.
Our suggested minimum record is deliberately small. It does not require collecting entire third-party datasets.
- Source or traceable source reference
- Affected domain or agreed identity
- Event, observation and review dates
- Signal type and confidence in attribution
- Recommended check, owner and outcome
A worked example
Fictional case: an old employee address appears in a historical record. The employee has left. The first question is whether the identity and connected application access were actually disabled. The record alone does not show an attack happening now.
Unexplained activity involving a still-active account would call for a different investigation. Monitoring helps decide what to examine; it does not replace that examination.
Passwords and sessions are separate
Microsoft explains that applications can control their own session tokens. A central access change does not automatically terminate every application session.
Our recommended response is application-specific: identify the account, session, permission and device involved before selecting a measure. Trying exposed credentials merely to make a finding sound stronger is not part of this approach. [2]
Define the engagement
Level 3 agrees domains, identities, permitted sources and intervals in advance. A source lookup, direct observation of accessible dark web sources and an incident investigation are distinct activities. The report should preserve those distinctions.
A practical acceptance test is whether the recipient can see why a signal matters, which evidence supports it and what needs checking next. Gaps in coverage remain visible. More matches alone are not a better outcome.
Related reading
Sources & further reading
Primary sources checked on 26.09.2026.
Sources and limitations are identified in the article.