Sri Lanka Becomes the 48th Government to Get Breach Data Free. Your Business Pays for It.

Sri Lanka became the 48th government to join Have I Been Pwned’s free service for national cyber teams on 23 August 2026. Sri Lanka CERT can now check every Sri Lankan government domain against the breach data held in HIBP. That looks like small news. For UK businesses, though, it raises a harder question: who does credential monitoring for your staff logins, and what happens when a hit lands?

What Sri Lanka CERT actually gets

The free government service gives a national CERT domain-level search across HIBP. Instead of checking one address at a time, the team queries a whole domain. Back comes every exposed alias, with the breaches it turned up in. Troy Hunt, who runs the service, has offered this to national agencies since 2018.

The UK has had it since March of that year. The NCSC can query any .gov.uk domain on demand, and Australia’s ACSC can query any .gov.au domain. Hunt was blunt about the terms at the time: “I’ve made this available to the NCSC and the ACSC without any commercialisation whatsoever.” Agencies also get a webhook. So a fresh breach touching government addresses reaches them in minutes, not months.

Recent additions include Bhutan, the Bahamas, the Philippines and Nepal. Sri Lanka makes 48.

Why exposed logins are a timer, not a filing job

A leaked staff password is rarely used the day it leaks. It sits in a dump. Then it gets traded, and tested against your login page. After that, someone walks in wearing a valid badge.

The Verizon 2026 Data Breach Investigations Report puts a number on that delay. Take its ransomware victims who had an earlier credential leak. Half of them were hit within 95 days of that leak surfacing. So the gap between exposure and impact runs to weeks, not years.

The same report found ransomware in 48% of breaches, up from 44% the year before. Attack paths have shifted, because vulnerability exploitation has taken over as the most common way in. Stolen logins still do plenty of damage, though. They also leave far fewer traces than an exploit does.

None of this needs technical brilliance either. One crew extorted two large US law firms after they simply phoned the reception desk and talked their way in.

The gap between governments and everybody else

Here is the awkward part. A national CERT gets domain search for nothing. A 60-person accountancy firm does not. HIBP’s FAQ says larger domains “normally require a subscription in order to see the search results”. The API documentation puts domain queries behind a Pro-level key. Some breaches carry a subscription-free flag, so a small domain may still see partial results.

Either way, you have to prove you control the domain first. Verification runs through the HIBP dashboard or the API. An unverified domain gets an HTTP 403 for its trouble. That guard makes sense. It also means credential monitoring needs an owner, and in most small firms nobody holds that job.

What credential monitoring looks like in practice

Start with the domains you forget. Most firms check the main one. Then they miss the old trading name and the marketing microsite. They miss the acquired subsidiary, too, along with the mailboxes left over from a supplier project. Attackers do not miss them.

Next, decide what happens when a hit lands. A list of exposed addresses is worth nothing without a response behind it. Write the steps down and keep them short. Force a reset. Confirm MFA on that account. Review sign-in logs for the past 90 days. Look for mailbox rules the user never created.

Then stop treating the reset as the whole answer. The NCSC is direct on this: “regular password changing harms rather than improves security”. Blanket expiry just pushes people towards predictable variants of the same word. Block common and breached passwords at the point where users choose them. Then put MFA on anything reachable from the internet.

The accounts that slip through

Human mailboxes get attention. Everything else tends not to. Shared inboxes, service accounts and contractor logins rarely sit in the joiners and leavers process. Nor does the generic address on your contact page. So they age quietly.

Those accounts also tend to skip MFA, because a shared login is awkward to protect with a phone. When one turns up in a breach dump, an attacker gets access with no owner watching it. Ask your provider which accounts are exempt from MFA today. The answer is usually longer than expected.

Password reuse widens the same hole. Credential monitoring on your corporate domain will never see a staff member’s private Gmail. That is often where the reused password sat.

Do this in the next fortnight

• List every domain the business owns, including parked and legacy ones.
• Verify the live domains in HIBP and read what is already exposed.
• Check MFA coverage for every account that appears in the results.
• Add a breached-password deny list to your directory or identity provider.
• Name the person who reads the alerts and decides what happens next.

None of that needs a budget round. It needs an owner and about a day of work. MFA on cloud services is already a Cyber Essentials requirement, so many firms are part way there.

Where testing fits alongside credential monitoring

Monitoring tells you a password is out there. It does not tell you what an attacker could do with it. That question belongs to an internal network penetration test. Take a plausible exposed account, then see how far it reaches: email, file shares, VPN, internal apps.

Plenty of organisations find that a single junior account opens far more than expected. A red team assessment pushes the question harder. It chains one weak login into the access an attacker would really want.

So treat credential monitoring as the smoke alarm, not the fire brigade. Governments now get the alarm for free. Everyone else has to buy it, and then act on it.