Dark web & breach monitoring
TSNC continuously checks whether your school's email domains and your staff's emails appear in known data breaches. When something shows up, we tell you — fast.
What we monitor
- Domain-level breaches — anytime
@yourschool.eduappears in a known dataset - Per-user breaches — each staff member's individual email checked against HIBP's breach corpus
- Compromised passwords — browser extension warns when a user's vault entry matches a known breached password (without sending the password anywhere — uses k-anonymity)
How alerts work
When a new breach lands that affects your domain or a user's email, we send:
- Email to admins — the org's principal and IT admin get a heads-up with breach details
- In-app notification — appears on the admin dashboard until acknowledged
- Per-user notification — the affected staff member sees a banner urging them to rotate any passwords they've reused
We don't flood you. Old breaches re-classified by HIBP don't re-alert. New breaches do.
- Don't panic — most breaches are old credential leaks the affected user already knows about.
- Identify which sites used the breached email + (likely) similar passwords.
- Have the user rotate passwords on those sites — start with email, banking, school accounts.
- Make sure their TSNC vault master password isn't reused anywhere else (it shouldn't be, but verify).
- Consider running a one-off phishing campaign — attackers often follow up breaches with credential-stuffing campaigns.
Domain monitoring setup
We monitor any email domain that staff members use to log in. If your school uses@stmarys.edu AND @stmaryscatholicschool.org, both are monitored. Add or remove domains under Settings → School Email Domains.
Per-user breach monitoring
Optionally, each staff member can register one personal email (e.g., their Gmail) for breach monitoring. Useful because most credential leaks come from sites they used personally, and the password they used at that site is often the same as their work password.
The personal email setting is opt-in per-user, not org-wide. Staff members opt in themselves under their user settings.
The browser extension's password breach warning
When a user logs into a site using the TSNC password manager, the extension checks the password they're submitting against the HIBP breached-password database. If it matches a known breach, a warning appears.
The check uses HIBP's k-anonymity API: only the first 5 characters of the password's SHA-1 hash leave the device. The actual password never leaves your browser. This is a widely-used pattern; see HIBP API docs.