What it is, and what gets confused with it
A credential leak is the public exposure of username and password pairs, API keys, or tokens belonging to an organization, outside its control.
It is not a breach. The company was not compromised when the credential leaked. It becomes compromised when someone uses the credential, and between those two events there are usually months of silence.
Where they come from
Almost never from inside.
The most common origin is a breach at a third-party service where an employee used their corporate email. The service was compromised, the dump circulated, and the credential pair sits there with the company domain in it. The company had no incident at all and still has exposed credentials.
The second origin is infostealer malware on the personal machine of someone who also accesses corporate systems. It collects whatever is saved in the browser and ships it. What comes out is not an old password: it is a password in use, with the session alongside it.
The third is code. An API key committed to a repository, a config file published by mistake, a token inside a package that shipped.
Why it raises no alert
This is the point that makes the subject underrated.
Access made with a valid credential is, to every control, legitimate access. There is no exploited flaw, no payload, no signature to recognize. The SIEM logs a successful login, the most common event of the day.
Behavioural detection helps when the pattern departs sharply, and does not help when the adversary logs in during business hours from the same region. This is why a leaked credential is the cheapest way in available: nothing has to be broken.
Why reuse multiplies the problem
The same password used in three places turns one leak into three accesses.
The corporate aggravator is that a company's authentication surface is larger than it maps. VPN, webmail, the admin panel of an inherited system, a staging environment against the same directory. One of them accepting the credential is enough.
What to do with a finding
Rotating the credential is the first move and not sufficient, because the session may already be active. Terminating sessions goes with it.
The move that changes the pattern is reducing the authentication surface. Every panel exposed without need is one more door accepting the same key, and most of them never needed to be reachable from the open internet.
Continuous monitoring matters because validity is the variable. A password leaked in 2021 and already rotated is a historical record. One leaked yesterday and still valid is an incident that has not happened yet. CSURFACE's credential monitor cross-references public exposure against the organization's domains to separate the two.