Use a breach notification service such as Have I Been Pwned to see whether addresses on your domain appear in known data breaches. Sign in to its dashboard, add the domain you own, and use the results to reset passwords and turn on MFA for the affected accounts.
What the service does
Have I Been Pwned was created by Troy Hunt in 2013 as a free resource for anyone to assess whether an online account may have been put at risk in a data breach. Its sign in page says the dashboard supports searching for your email address in sensitive breaches, viewing stealer log entries that captured your email address, and adding and searching domains you own.
It shows that data exists. It does not tell you whether someone is using it against you.
Why a nonprofit should look
Your staff and volunteers signed up to many outside services with work addresses: newsletters, tools, conference sites. When one of those services is breached, the leaked address and password pair may be tried against your email and your donor tool. Reuse of passwords turns a breach somewhere unimportant into a break in somewhere important.
Steps
- Pick a domain owner. Domain search requires proving you control the domain. Whoever holds your DNS or email admin should do this.
- Sign in to the dashboard. The sign in uses an emailed link or a passkey.
- Add your domain. Follow the verification steps on the site.
- Review the results. Note which addresses appear and in which breach.
- Act on each one. Change the password for the breached service and any account that shared it.
- Check plan terms. Some features, such as API keys and subscriptions, are paid, so read what applies to your use before relying on it.
What to do with a hit
| Finding | Action |
|---|---|
| Address in an old breach | Confirm the person uses a unique password now |
| Address in a recent breach | Reset passwords and review sign in activity |
| Address in a stealer log | Treat the device as possibly infected; scan it and reset everything stored on it |
| Many hits on one person | Offer help with a password manager |
Stealer logs are different from older breaches, because they come from malware on a person's own device. That calls for cleaning the device, not just changing one password.
Make the response kind
People feel embarrassed by hits. Say plainly that nearly everyone appears somewhere and the goal is fixing the exposure. Offer the same help to everyone, including leadership. If you are building habits, see our guide to phishing red flags for staff and volunteers.
Use it as a recurring check
Put a quarterly reminder in a shared calendar to review the domain results. Most nonprofits can fold it into a meeting they already hold, and it gives you an early signal that a volunteer's old login is circulating.
Quick check
Does a hit mean we were hacked?
No. It means an address appeared in leaked data from some service. Treat it as a reason to change passwords, not proof of an intrusion into your own systems.
Should volunteers use personal addresses instead?
That changes where exposure shows up but not the risk. Unique passwords and MFA matter more than the address.
Sources
Last reviewed: 19 October 2026.
