What Should a Small Business Do After a Password Leak?

Published 2026-11-05

TL;DR: Treat a leaked password as a possible account-compromise event. Change the password everywhere it was reused, lock down recovery and sign-in settings, check for takeover signs, and document what happened before resuming normal work, following CISA, FTC, and NIST guidance.

Intro

A small business should treat a leaked password like a possible account-compromise event, not a harmless “oops.” First, change the password everywhere it was reused, lock down sign-in and recovery settings, and check for signs of unauthorized access before you go back to normal. That lines up with CISA and FTC guidance on containment, account recovery, and using unique passwords. If business email was involved, look for forwarding rules, recovery changes, and other signs of account takeover.

Confirm whether the leak affects a business account

Start by figuring out what the exposed password actually belongs to. Was it business email, a shared mailbox, an admin account, or any account that can reach customer data, billing, payroll, or payment tools? If it is tied to something that can reset passwords or approve access, treat it as high risk right away.

If you are still at the “is this even ours?” stage, use the site’s related breach-checking topic for the first identification step, then move from guesswork to a real inventory of the account and where it connects. That is the difference between a nuisance and a full-blown “why is accounting locked out?” afternoon.

Contain the account right away

Once you confirm the account matters, contain it immediately. Change the affected password. Change any other passwords that were reused. Sign out other sessions if the service allows it. Review recovery email addresses, phone numbers, and backup codes, and remove anything suspicious or unfamiliar. If a login method no longer looks safe, disable it and replace it with something you can actually control.

CISA and NIST both support tight account recovery and session-control hygiene, because a leaked password is only one piece of the mess. If an attacker already has the session token or a recovery path, a password change alone can be too polite.

Check for signs of account takeover

Now look for the obvious weirdness, in plain language. Search for new inbox rules, unexpected sent mail, password reset emails you did not request, changed recovery contact details, unfamiliar devices or locations, and new admin or sharing permissions.

CISA incident-response guidance points businesses toward this kind of quick triage, because attackers often leave little clues before they make a bigger move. The goal is not to become a forensic wizard. It is to spot the “this mailbox is acting like it drank three coffees” signs before more damage spreads.

Protect the rest of the business accounts

Do not stop at the one password. Review every account that used the same password, or is linked to the same email address. Then tighten access to any service that connects to email, billing, payroll, or customer records.

FTC and NIST guidance both support unique passwords and least access, which means people and systems should only have the access they actually need. If one mailbox or login can reach too much, a leak turns into a very efficient tour of your business systems.

Tell the right people and document what happened

Notify the email provider if the account is behaving strangely or recovery details were changed. Tell internal team members who use the account so they do not keep trusting a compromised mailbox. If payment systems, banks, or processors could be affected, notify those partners too.

If business data may have been exposed, or if the activity could involve a crime, consider law enforcement and customer notification where appropriate. Keep a simple incident log, what happened, when you noticed it, what you changed, and who you told. CISA-style response planning favors that kind of record because it keeps the business from relying on memory, which is charmingly unreliable under stress.

Worked example: leaked shared mailbox password in a two-person office

Say a two-person office learns that the password for a shared mailbox showed up in a breach. Here is the practical sequence:

Change the shared mailbox password.
Review forwarding rules, filters, and recovery settings.
Sign out active sessions and remove anything unfamiliar.
Check recent mail activity for sent messages, password reset requests, or permission changes.
Reset any connected services that use that mailbox for alerts, billing, or logins.
Confirm neither staff member reused the same password on another account.

That is enough to get from “we have a problem” to “we reduced the blast radius” without needing a full security theater production.

Prevent the next leak from becoming an incident

After the cleanup, harden the basics. Use unique passwords. Turn on MFA. Keep a written recovery plan. Limit who can reset passwords or change recovery settings. Review access on business-critical accounts, especially email, billing, payroll, and customer record systems.

That mix is backed by FTC, CISA, and NIST guidance, and it matters because the next leaked password should not automatically become the next outage. A small business does not need perfection. It needs fewer easy doors left propped open.