Knowing that an address has appeared in a leak costs nothing and changes nothing: it is true for almost everyone. The question that engages your responsibility is twofold: does this leak still open a door into your organisation, and whom must you notify, within what deadline.
A credential leak is not an isolated event on your side: it is a worldwide flow. To give an order of magnitude, the public reference in the field indexed 1 957 476 021 unique addresses in a single operation in November 2025 (figure published by Have I Been Pwned).
Practical conclusion: the presence of your domain name in a leak is likely, and it is not in itself actionable information. What matters is what comes next.
None of these three answers is found in a breach database. They are read inside your directory or your tenant, with your agreement.
This procedure follows the GDPR, Articles 33 and 34. Official text. It does not replace legal advice: we are auditors, not lawyers. Official sources: Regulation (EU) 2016/679, Articles 33 and 34 (EUR-Lex); EDPB Guidelines 9/2022; CNIL: personal data breaches; CNIL: notifying a breach; Directive (EU) 2022/2555, Article 23 (EUR-Lex).
The competent data protection authority for 30 countries of the European Economic Area. Twenty-seven lines were verified individually against the official list of members of the European Data Protection Board, and carry the link to that source; for Liechtenstein, the source is the authority's own website; for Iceland and Luxembourg, the verification is not published: check the authority against the Board's list before notifying.
A missing line means we could not verify it, not that it does not exist. We prefer a shorter table to a less accurate one.
8 public sources describe what an attacker sees of you before entering: certificate logs, DNS and mail records, exposed services, look-alike domain names, code publications, indexed documents.
That is where the three answers that matter are found. We audit Microsoft 365 and Active Directory from your own workstation, read-only, and we cross-check what the leak announces against the real state of your accounts.
The engine that queries these 8 sources is written and working, but it has not yet run with a client. We are therefore not selling a self-service diagnosis here: we run it ourselves, with you, and you are told that you would be among the first. We prefer to say so rather than let you find out.
The Microsoft 365 audit and the Active Directory audit, by contrast, already run at real client sites.
Free analysis of your domain: syaga.eu/scan. The free tool “Is my Microsoft 365 under attack?” is coming.
Describe your situation See the other doors