RuleCrest
Add-onsBreachMon
Coming soonKnow when a work login leaks, before someone uses it.
BreachMon is breach monitoring for work emails. It watches the addresses your organization uses for exposure in known breaches and leaked-login collections, and tells each person in plain words what to change.
Watch the addresses, help the person, keep the password out
Add the work domain
An administrator adds the organization's email domain and proves it is theirs. People sign in from the dashboard; nobody makes a new account.
Watch for exposure
BreachMon checks the work addresses against known breaches and collections of logins stolen by malware, and checks again on a schedule.
Give each person a next step
If an address appears, the person sees where, roughly when, and what to do: change that password, stop reusing it, turn on a passkey.
Show administrators counts
Administrators see how many addresses are affected and who needs help. BreachMon never shows or stores a leaked password, only that an address appeared and what kind of data was exposed.
Two halves of the same problem
A phishing message works best when it contains real details about the person it targets. Broker listings supply the details. Leaked logins supply the way in. Closing both makes the message harder to write and the account harder to open.
ScrubMyPII
Removes what anyone can look up: home addresses, phone numbers and relatives on data-broker sites.
BreachMon
Watches for what attackers may already hold: logins that leaked in breaches.
Stolen logins are the most common way in
These figures come from published reports, named under each one and listed with their sources below.
What leaked logins and shared vendors have cost
Ten events from the last three years, each with what it teaches a small organization. Counts are as reported; where sources differ, or a number is the attackers' own claim, the card says so.
-
May 2026 · Education
Instructure (Canvas)
A group known for voice-phishing campaigns stole data from the learning platform and defaced school login pages after a ransom was refused. Reporting puts it at more than 30 million students and staff; the attackers claimed far more, which has not been confirmed independently. The company's disclosure named names, emails and student IDs.
What it teachesOne vendor's breach becomes every school's problem, and names plus emails are exactly what a believable phishing message needs.
-
August 2026 · Healthcare
CareCloud
A cloud host of electronic health records confirmed that attackers stole records of at least 3.7 million patients.
What it teachesSmall practices depend on vendors like this one, so a vendor's breach lands on them too.
-
2026 · Health insurance
DentaQuest
A dental insurer's breach exposed the health data of 15 million people, reported as the largest known healthcare breach of the year. Some regulatory filings report a higher count.
What it teachesNames, birth dates and member numbers stay useful to scammers for years after the breach.
-
June 2026 · Software vendor
Klue
An extortion gang got in with a login created for a pilot in 2022, then stole the cloud keys of about 200 of the company's customers.
What it teachesAn old login that nobody remembered was enough. Leaked and forgotten credentials do not expire on their own.
-
March to May 2026 · Software supply chain
Backdoored developer tools
Tampered open-source tools stole passwords and access tokens from the computers that installed them. The stolen credentials were then used to reach other organizations, including well-known technology companies.
What it teachesStolen logins carry an attack from one organization to the next.
-
August 2025 · Third-party app
Salesloft Drift
Attackers stole access tokens from a chatbot add-on and used them to reach the Salesforce accounts of more than 700 organizations. Some support cases held passwords and keys that customers had pasted in. A claimed total of 1.5 billion records was the attackers' own figure and was not confirmed.
What it teachesPeople paste secrets into tickets and chats, and those are only as safe as the account they sit in.
-
June 2025 · Leaked collections
16 billion login records in exposed collections
Researchers reported about 30 exposed collections holding more than 16 billion login records, mostly gathered by password-stealing malware and earlier breaches. It was a compilation, not one company's breach.
What it teachesOld and new leaks are merged into lists attackers can search, and an address that appeared once can turn up again.
-
February 2024 · Healthcare payments
Change Healthcare
Attackers used a compromised account that had no second sign-in step to reach a major claims processor. UnitedHealth said more than 100 million people were affected.
What it teachesOne login without a second step was the way in to a national payment system.
-
March 2024 · Telecom
AT&T customer records
Records of about 73 million current and former customers were posted online, including some passcodes, and AT&T forced a mass passcode reset.
What it teachesOnce personal details are public they are copied into other lists. That is the problem ScrubMyPII works on from the other side.
-
May to June 2024 · Cloud data
Snowflake customer accounts
Attackers used logins stolen earlier by password-stealing malware to open about 165 customer accounts that had no second sign-in step. Ticketmaster (reported at about 560 million customers) and AT&T call records were among the data taken.
What it teachesThe logins were valid. Nobody had to break into a system; they had to find a list.
How it plays out in a small organization
Illustrative scenarios built from the patterns above. They are not reports of real events.
The reused password
A bookkeeper at a 25-person firm uses one password for a shopping site and for work email. The shop was breached years ago. An attacker signs in to the work mailbox, reads a pending invoice and emails the client new bank details.
With BreachMon, the bookkeeper is told the week the address appears, changes the password and turns on a passkey before anyone tries it.
The forgotten login
A clinic's former front-desk contractor still has a working login. Their address turns up in a leaked collection. Nobody remembers the account exists.
The administrator's count shows one exposed address that belongs to someone who has left, and switches it off the same day.
The vendor breach
A school's records vendor is breached, and staff names, roles and email addresses spread. Within days, convincing "update your account" messages start to arrive.
BreachMon tells the office which staff are affected and what to expect, so the first message that arrives is recognized instead of opened.
What BreachMon receives from RuleCrest
It receives
- An opaque identifier for the person that is stable for this add-on and organization.
- The organization, the person's name and email, and their role.
- The seat count the organization bought.
It does not receive
- Anything about training results. A launch never changes a person's training record.
- A password. RuleCrest has none to give: people sign in with passkeys.
Sources
Checked October 20, 2026. Counts differ between sources; where they do, this page says reported or claimed.
- Verizon, 2025 Data Breach Investigations Report, and its small and medium business snapshot (credential abuse, third-party involvement, ransomware at small and medium businesses).
- IBM, Cost of a Data Breach Report 2025 (United States and global averages).
- TechCrunch, "Leaks, data breaches, and ransom notes: The worst hacks of 2026 so far," September 15, 2026 (Instructure, DentaQuest, CareCloud, Klue, the open-source supply chain attacks).
- FINRA, notice on the Salesloft Drift supply chain attack, and press coverage of the campaign (August 2025); press coverage of the 16 billion login records report (June 2025).
- TechCrunch, "2024 in data breaches," and press coverage of Change Healthcare, AT&T and the Snowflake customer accounts (2024).
Want this next to your training?
Sign in to your organization, or look at the other add-ons.