Credentials

The Credentials section gives you a dedicated view of everything Stoïk has found related to leaked credentials and compromised devices for your organisation.

How it works

Stoïk Protect is connected to three external intelligence providers:

LeakCheck monitors public data breaches — incidents where a company's user database was hacked and dumped online.
Hudson Rock and Flare collect infostealer logs — data silently exfiltrated from employee devices infected by malware.

From the assets you've declared in External Scan (domain names, IP addresses), Stoïk continuously queries these providers for anything related to your organisation. Results flow into two tabs: Exposed Data and Alerts.

Exposed Data

Exposed Data is the full intelligence feed — every piece of data Stoïk has found leaked about your organisation online.

It is organised into three sub-tabs:

Sub-tab

What it contains

Raw logs

Every leak record, all data types (credentials, cookies, emails, phone numbers, IP addresses, …)

Credentials

Credential-type leaks only: URL + login + password

Cookies

Session cookies exfiltrated from infected devices

For each entry, the side panel shows the intelligence provider that found it, the estimated leak date, the data type, and any linked alert.

What to do: Review new entries and acknowledge them once investigated. Acknowledged entries remain visible but no longer count as new.

An entry in Exposed Data does not necessarily mean the credential still works today. If we have confirmed it does, it will appear as a Valid Credentials alert in the Alerts tab.

Alerts

Alerts are what Stoïk has actively confirmed needs immediate action. There are two types:

Valid Credentials

A Valid Credentials alert means Stoïk found a leaked URL + login + password in Exposed Data and confirmed it still grants access to one of your services today (Microsoft 365, Fortinet VPN, Citrix, exposed web panels, and others).

This is not a historical leak. It is a working credential that an attacker could use right now.

What to do:

Reset the password for the affected account immediately.
Enable multi-factor authentication (MFA) on that account if not already active.
Check whether the same password is reused on other services — change those too.
Mark the alert as resolved once done. Stoïk will verify the remediation.

Infected Device

An Infected Device alert means one of your employee devices has been identified as compromised by infostealer malware, by Hudson Rock or Flare. The device is actively exfiltrating data — passwords, cookies, browser autofill, saved credentials — until it is fully wiped.

What to do:

Isolate the device from the network immediately (disconnect from Wi-Fi and LAN).
Wipe and reinstall the device from scratch. A virus scan alone is not sufficient.
Force a password reset for all accounts used on that device.
Invalidate active sessions on those accounts (sign out everywhere) to neutralise any stolen session cookies.
Enable MFA on the affected accounts.

Personal devices Stoïk detects infected devices based on professional account activity — it cannot determine whether the device itself is a company-issued machine or a personal one. It is therefore possible that a personal device (a phone or laptop on which an employee connected a professional account) appears as an Infected Device alert. If you identify an alert as relating to a personal device, you can update the device type directly from the alert side panel:

Open the alert.
Switch the Device type from Professional to Personal.

The alert moves to Dismissed status. It remains visible in the list but is filtered out by default and no longer counts as an active alert.

Even on a personal device, the professional accounts used on it remain at risk. Before dismissing the alert, make sure the employee has reset their passwords and invalidated active sessions for any professional account they accessed on that device.

If you believe an alert is a false positive, you can request a discard directly from the side panel. Stoïk will review the request before closing it.

How Alerts and Exposed Data are linked

Valid Credentials alerts are built from Exposed Data: Stoïk picks leaked credentials from the feed and tests them against your services. Those that still work are promoted to Alerts.

Infected Device alerts work in the other direction: each compromised device typically produces a payload of stolen data (passwords, cookies, browser data) that flows into Exposed Data. Opening an Infected Device alert shows you the associated Exposed Data entries.

Data refresh frequency

Stoïk queries each provider on a regular schedule:

Flare: Every 24 hours
Hudson Rock: Every 72 hours
LeakCheck: Every 7 days

Exposed Data and Infected Device alerts follow the same schedule as their respective provider.

Valid Credentials alerts are tested as soon as new exposed credentials are detected. Stoïk then retests them every 3 days until the credential no longer works, so the alert automatically resolves once the password has been changed.