Credential compromise response checklist

Revoke, rotate, hunt — this is not a statute

Audience: the incident commander facing leaked, phished, stuffed, or otherwise compromised credentials, and counsel, the insurer, and DFIR on the out-of-band bridge. The we've-been-breached page on this site is the first-moves hub. The preserve-evidence page on this site is the capture order for sign-in logs, session tables, and identity-plane audit. The was-data-stolen page on this site is the access-is-not-exfiltration map. The who-to-call page on this site is the contact order. This page is the credential-compromise runbook: revoke sessions and tokens, rotate the secret, enforce MFA, hunt persistence, and scope the blast radius. It does not rank identity vendors, DFIR firms, or MFA products, does not name any as the source of truth, and does not start a notification clock.

CISA's phishing-resistant MFA fact sheet (October 2022, last verified still listed on 7 September 2026) treats stolen passwords and phishable MFA as a current identity threat, not a solved one. CISA's phishing guidance (18 October 2023) is how credential harvesting starts. NIST SP 800-63B-4 is authentication and authenticator-management guidelines — AAL2 is two factors; AAL3 requires a phishing-resistant authenticator — guidance, not a statute that files a notice for you. OWASP's credential-stuffing cheat sheet is industry practice for stolen username/password pairs replayed against YOUR login. OWASP's session-management cheat sheet is industry practice for invalidating the session that is, for its lifetime, equivalent to the authenticator. Last verified 7 September 2026. Not legal advice.

• Revoke first, then rotate, then hunt. A new password with the old session still live is not containment. OWASP session management: regenerate or destroy the session after a password change and after a privilege change. NIST SP 800-63B-4 treats authenticator change as a reason to re-authenticate and bind a new session.
• Do not tip the actor. No in-band 'we see you', no public status page, no mass password reset from a possibly compromised identity plane. CISA: actors watch the response.
• Preserve identity-plane logs before you wipe the session table you still need. The preserve-evidence page on this site is that hold.
• The cloud-account-compromise-checklist page on this site is the preserve-logs-first tenant runbook when the identity minted cloud keys. The repository-compromise-checklist page on this site is the access-and-token audit, planted-commit hunt, and secret-rotation runbook for a source host. The cicd-compromise-checklist page on this site is the freeze-and-audit runbook when the identity minted pipeline tokens.
• This page does not rank vendors, does not interpret YOUR policy, does not start a notification clock, and is not legal advice.

What to do now

Walk top to bottom. Unknowns belong on the list. Last verified 7 September 2026. Not legal advice.

• Declare the incident. Name one commander. Open an out-of-band bridge the actor cannot see (phone, a clean conference). The who-to-call page on this site is the contact order.
• Place the evidence hold on identity-plane logs: sign-in, audit, session issuance, OAuth grants, mailbox rules, API-key create/delete. Do not rotate those logs away to 'clean up.' The preserve-evidence page on this site is the capture list.
• Revoke sessions, refresh tokens, API tokens, and personal access tokens for the compromised identity — and for any identity the actor could have minted from it. Force sign-out everywhere the provider lets you. This product does not revoke sessions.
• Rotate the credential at the source: password, key, token, certificate, or CI secret. Then revoke the old value. A commit that deletes a leaked key is not rotation. Secrets in code or CI are a source on this page.
• Enforce MFA on the recovered identity and on privileged peers, preferring phishing-resistant methods (FIDO/WebAuthn or PKI) per CISA's fact sheet. Number matching is an interim against MFA fatigue, not the target. This product does not enforce MFA on YOUR IdP.
• Hunt persistence: OAuth apps and consent grants, mailbox forwarding and inbox rules, new API keys, new authenticators, new recovery emails or phones, new privileged roles. The table below is that list.
• Scope the blast radius: which systems that identity could reach, which secrets it could mint, which mailboxes it could forward. Access is not exfiltration. The was-data-stolen page on this site is that map. This product's blast-radius search is package exposure, not an identity hunt.
• Page counsel and the insurer if YOUR plan or policy requires prompt notice. A stuffed or phished login can still be a notification question. This page does not start a clock.

Revoke-rotate-hunt checklist

Containment for a compromised credential is not 'change the password and hope.' The session is, while it lives, equivalent to the authenticator (OWASP Session Management Cheat Sheet — industry practice). NIST SP 800-63B-4 requires re-authentication and a new session after authenticator change. CISA identity guidance treats phishing-resistant MFA as the durable control after a password is already in someone else's hands. Walk the rows in order. Last verified 7 September 2026. Not legal advice.

Persistence-mechanism hunt list

Rotation without a hunt leaves the door the actor cut. CISA / ASD ACSC Detecting and Mitigating Active Directory Compromises (25 September 2024) is recommended strategies for identity persistence in AD — guidance, not a statute; the same idea applies in a SaaS identity plane: look for what the actor added that survives a password change. Each provider publishes its own OAuth-grant, mailbox-rule, and key-inventory screens; this page does not pick a vendor and does not rank any. Last verified 7 September 2026. Not legal advice.

Secrets in code and CI are a source

Phishing and stuffing are not the only way a credential leaves. A secret committed to git, pasted into a ticket, stored in a CI variable, or baked into an image is a live credential in a place the actor can read — now or from history. Version control keeps the old value. Deleting the line is not revocation. Last verified 7 September 2026. Not legal advice.

• Treat a committed secret as already compromised. Rotate at the issuer, revoke the old value, then remove it from code going forward. History, forks, CI logs, and artifact stores still hold the old copy.
• CI variables, deployment secrets, signing keys, and bot tokens are credentials. A pipeline that prints a secret into a log is a leak. The cicd-compromise-checklist page on this site is the freeze-and-audit, secret-rotation, and artifact-provenance runbook.
• This product does ingest GitHub secret-scanning alerts into Security findings (exposed secrets as findings). It does not rotate the secret, revoke the token, or hunt whether that key was used.
• Chat, paste bins, screenshots, and 'temporary' shared docs are sources too. If the secret was there, assume it was read.

Scope the blast radius

Blast radius here is what that identity could reach, mint, or forward — not a finding that data left. Access is not exfiltration. The was-data-stolen page on this site is the evidence-to-conclusion map. The ransomware-checklist page on this site is the isolate-don't-wipe scenario if encryption started from the stolen identity. The cloud-account-compromise-checklist page on this site is the preserve-logs-first tenant runbook when the identity minted cloud keys. Last verified 7 September 2026. Not legal advice.

• Name the systems, mailboxes, repos, cloud roles, SaaS apps, and secrets the identity could use. Privileged peers and service accounts it could mint are in scope.
• Put first-success and last-success sign-in, token issue, and grant-create events on the timeline. Unknown first-access is a gap, not a clean bill.
• This product's blast-radius search is over captured dependencies — transitive npm when a lockfile was fetched. That is package exposure in YOUR tree, not an identity hunt and not a finding that a session was used.

Where this shows up in ShipReady Metrics

The signed-in app does not revoke sessions, rotate passwords, force sign-out, enforce MFA on YOUR identity provider, hunt OAuth grants, hunt mailbox forwarding rules, or invalidate tokens. It does ingest security findings, including GitHub secret-scanning alerts (exposed secrets as findings, typically critical). Security findings is where those land, alongside Dependabot, SAST / code scanning, and DAST. Security also has a blast-radius search over captured dependencies — transitive npm when a lockfile was fetched — which is package exposure, not an identity blast radius. If you already have a session: signed-in app → Compliance → CRA reporting tracks the 24-hour / 72-hour / 14-day ladder from your recorded awareness for findings the org has classified as CRA-in-scope. That ladder is not a credential-compromise runbook, it does not start a clock for you, and it is not a determination that CRA applies. A named human still submits. None of those surfaces revokes a session or rotates a password.

Primary sources (last verified 7 September 2026)

Every operational claim on this page is taken from one of these. If a later revision of a source changes the advice, the date above is how you can see we have not re-checked yet.

CISA, Implementing Phishing-Resistant MFA (October 2022 fact sheet) remains the current CISA identity guidance this page cites for phishing-resistant MFA as the target after credential theft, with number matching as an interim against MFA fatigue — guidance, not a statute, last verified still current on 7 September 2026. CISA, NSA, FBI, and MS-ISAC, Phishing Guidance: Stopping the Attack Cycle at Phase One (18 October 2023) is how credential harvesting starts. CISA, ASD ACSC, and NSA, Detecting and Mitigating Active Directory Compromises (25 September 2024) is recommended strategies for identity persistence in AD — guidance, not a statute; the hunt-what-survives-a-password-change idea is what this page applies to SaaS grants, mail rules, and keys. NIST SP 800-63B-4 (final 31 July 2025), Digital Identity Guidelines: Authentication and Authenticator Management, remains the current final authentication volume this page cites (AAL2 two factors; AAL3 phishing-resistant; re-authentication and new session after authenticator change) — guidelines, not a statute. OWASP Credential Stuffing Prevention Cheat Sheet and OWASP Session Management Cheat Sheet are industry practice (MFA as the durable stuffing defence; session equivalent to the authenticator; invalidate after password / privilege change). Provider identity-security documentation is generic: each IdP publishes revoke-all-sessions, OAuth-grant review, and mailbox-rule audit steps for its own plane; this page does not treat any vendor's doc as the source of truth and does not rank vendors. NIST SP 800-61r2 remains the current final Computer Security Incident Handling Guide this cluster cites for containment then eradication then recovery.

Frequently asked questions