Compromised Credentials findings are powered by Hudson Rock, a trusted provider of high-quality compromised credential intelligence at scale.
The source of these credentials is from Stealers that are actively being sold on the dark web. They are not part of large public breach dumps (such as Have I Been Pwned), which makes them especially relevant and actionable.
🔍How this works
Using data from Hudson Rock, we:
Compare compromised credentials against the domains listed in your company assets
Identify whether:
An employee in your organization has exposed credentials, or
Credentials connected to your company’s services are being sold on the dark web
❗Criticality types
The Compromised Credentials report includes two types of critical findings:
🔴 Company Employee
This means credentials belonging to your company’s employees are circulating on the dark web.
Why this matters
These credentials can be used to access internal systems
They significantly increase the risk of account takeover and lateral movement
What to do
Immediately disable or delete the account, or
Force a password reset
🔴 Company Service
This means credentials of external users (for example: Gmail users, students, or non-company domains) are being sold on the dark web and were stolen while using your service or company link.
Important to know
This does not mean your service itself was compromised
It means attackers are selling credentials that can be used to access your service without authorization
Why this matters
Unauthorized users may gain access to your platform
This can lead to abuse, fraud, or reputational risk
What to do
Review affected accounts
Invalidate exposed credentials
Apply additional access controls if needed
🔍How to mitigate Compromised Credentials?
Send [email protected] a request to share a protected sheet containing the relevant compromised credentials.
Panorays Support will provide an XLS file, directly to the company whose credentials were compromised.
You will be asked to resolve all compromised users (for example, disabling accounts or forcing password resets).
Once resolved, you must confirm completion by emailing:
[email protected]After confirmation:
We remove the findings from the Panorays platform
Following the next company assessment, the finding will be marked as Closed
❓Why may the finding reopen?
A compromised credentials finding may reopen for one of the following reasons:
New credentials were discovered
→ These must be resolved again using the same process.The customer marked the finding as “Claimed Fixed” without confirming resolution via email.
→ Since the credentials were never removed on our side, the finding will reopen automatically.
⚠️ Important: Claiming a finding as fixed on the platform does not remove compromised credentials unless Support receives confirmation.
l