How to Check if Your Professional Domain Has Been Breached

If you use a professional email domain — @yourlawfirm.ro, @yourclinic.eu, @yourpractice.com — there is a real chance that one or more email addresses on that domain have appeared in a data breach. Not because of anything you did wrong, but because services you or your colleagues signed up for were compromised. This page explains what a domain breach means, how to check for it, and what to do if you find something.

What is a domain breach?

A data breach occurs when unauthorized parties gain access to a database containing user credentials or personal information. A domain breach means that one or more email addresses belonging to your professional domain appeared in one of these leaked databases. This matters because the compromised address may still be in active use; if passwords were reused across services, other accounts may also be at risk; under GDPR you may have an obligation to notify affected individuals and ANSPDCP; and clients who discover the breach independently may lose confidence in your practice.

How do breaches happen to professional domains?

Most domain breaches do not happen because your own systems were hacked. They happen because third-party services you signed up for were breached and your address was included in the leaked data; because former staff or colleagues reused work email addresses for personal services; or because old accounts were never deactivated after people left your practice.

How can I check if my domain has been breached?

The most widely used public resource is Have I Been Pwned (haveibeenpwned.com), maintained by security researcher Troy Hunt. It aggregates breach data from hundreds of known incidents and allows you to search by email address or domain. To check your domain: go to haveibeenpwned.com/DomainSearch, enter your professional domain, verify ownership via DNS or email, and results will show which addresses appeared in which breaches and when. This is a free check and a reasonable starting point. The limitation is that it is manual, point-in-time, and requires you to remember to recheck periodically.

What should I do if my domain appears in a breach?

Do not panic — assess first. Not all breaches are equal. A breach that exposed only email addresses is less serious than one that exposed passwords or sensitive personal data. Then: change compromised passwords immediately; enable multi-factor authentication on every account associated with your professional domain; assess your GDPR obligations — if the breach exposed personal data of your clients you may need to notify ANSPDCP within 72 hours; and document your response, as demonstrating appropriate action is as important as the action itself under GDPR.

Why manual checks are not enough

Checking once gives you a snapshot. Breaches are discovered and published continuously — a domain that was clean last month may appear in newly disclosed breach data today. For a professional practice, the gap between a breach being published and you finding out about it is a period of unmanaged risk. During that window, compromised credentials may be in active use, and your GDPR clock — 72 hours to notify — may already be running. Continuous domain monitoring closes that gap.

Solsignia Vigil

Solsignia Vigil is built specifically for this. It monitors your professional domain against breach databases continuously, alerts you when a new breach appears — immediately for high-severity incidents, in a weekly digest for lower-severity ones — and provides a guided remediation checklist so you know exactly what to do next. For paid subscribers, Vigil also discovers active email addresses on your domain automatically, maintains a living domain breach risk score, tracks your remediation history, and generates a client-facing PDF breach report framed around your GDPR and NIS2 obligations.