We Found the Admin Password in the Dark Web: A GRC Wake-Up Call

We need to talk about Fred again. We do. If you missed last week's episode, Fred isn't actually called Fred. Fred isn't actually one person.

Which was rather the problem. We talked about a regulated professional services business where several people had been using shared identities, including for Microsoft 365 and SharePoint. Yep. They were also running some spectacularly elderly computers, resisting some fairly basic changes, and trying to get themselves towards cyber essentials.

That's the one. And last week, you said that when several people share an identity, you lose one of the most basic things security gives you. Accountability. Who logged in?

Who downloaded the file? Who changed something? Who did what? Yep.

Well, since we recorded that, you've found something. We have. During a routine annual security check. Nothing clever.

Nothing prompted by an incident. Just one of the checks we routinely do. And the password associated with that shared Microsoft 365 admin identity turned up in a dark web data dump. Yes.

How old was the data? Around 11 months. So while everyone was arguing about why accounts needed separating, why stronger authentication mattered, and why all this security stuff was necessary. The password they were all relying on had already left the building.

Oh shit. And if you're now wondering whether one of your business passwords is sitting in the same sort of data, stay with us. I've got 10 dark web scans to give away before we finish. You kept that quiet.

I was trying to create suspense. You found an admin password in a breach dump. I think we already had suspense. Stay secure, stay strong in the digital fight.

Hello, I'm Lucy Harper. I'm here with Noel Bradford. And this week, Graham Faulkner has finally escaped whatever scheduling black hole we've been keeping him in. Hello, everyone.

Well, I was promised an episode. We checked the paperwork. There was paperwork? Apparently.

This is the fourth and final part of our little wonder through governance, risk, and compliance. Although, after what we've just found, wonder may be the wrong word. Stagger? Controlled?

Descent? Hobble through the burning wreckage? I want thinking a bit dramatic. However, I can work with that.

Well, what the hell else would you call it when you find your customer's Microsoft 365 admin password in a completely unencrypted dark web credential dump? Fair. I withdraw controlled descent. Over the last three episodes, we've asked three basic questions.

Governance asked who owns the decision. Risk asked what could go wrong and what you're going to do about it. Compliance asked whether you can prove you're actually doing what you claim. And this week, we get the bit nobody puts in the framework diagram.

Reality. Exactly. Which is normally the part that ignores the framework diagram completely. Because eventually somebody checks.

Or something happens. Or, in this case, a routine check finds something nobody wanted to find. And sometimes the evidence comes back and says the thing you were treating as a theoretical risk wasn't theoretical at all. That's where we are.

Before we go any further though, what exactly do we know? Good question, because we need to be very precise about what Noel actually found. Absolutely. Does finding this password in breached data mean somebody successfully broke into their Microsoft 365 tenant?

No, it just changes where it sits on the risk register. Do we know somebody maliciously used it? Again, no. The exposure predates any logs as the customer at the time wasn't under our management as was using the bare minimum MS 365 packages, not my recommended business premium tier.

Do we know exactly how the credential ended up in the dataset? Not from the fact that it appears there, no. However, looking at the dataset, we can see the same two users with two versions of the password. So logic would say it was a phish, and that someone tried logging in as themselves, and someone else, and cycled the passwords through.

Yes, we're talking about all accounts on the domain having the same or variance of the same password too. Good. Because I can already hear someone turning this into company hacked for 11 months and nobody noticed. And we aren't saying that.

What we can say is that a password associated with an important shared Microsoft 365 identity appeared in compromised credential data dating from at least 11 months ago. And that's enough to act on. More than enough. Full-scale incident declared and containment operations swung into place.

Because once a credential has appeared in that sort of data set, you have to assume secrecy has gone. Exactly. A password only really works as a security secret while it's secret. Revolutionary.

I try. And this wasn't just Betty's login to the Christmas lunch spreadsheet. No. This was associated with an identity being used across the business and carrying administrative privilege.

So we shouldn't sensationalise what you've found. No. But we also shouldn't minimise it. Definitely not.

And there's an important sentence here, isn't there? There is. Nothing happened. And we didn't notice anything happening.

Aren't the same statement. That's the whole bloody episode. Fine. Practical question.

You've found the credential in a dump. what happens next? First, you treat the credential as compromised. You don't sit around debating whether somebody definitely used it.

You remove the uncertainty, change it, remove shared use, review the account, review the sign in history, check privileges, check the authentication methods and work out what else that identity could touch. So this isn't interesting report, we'll put it in the folder. No, this is the secret is no longer secret, act accordingly. And then investigate.

As far as the available evidence allows. Sign-ins, devices, locations, activity. Anything that helps establish whether there was suspicious use. Which is where the shared identity comes back to bite you again.

Exactly. 11 months bothers me. It should. Not because we know somebody had access for 11 months.

Again, we don't. But because the credential had potentially been available outside the organisation, while everybody inside the organisation carried on as though the existing setup was good enough. Yes. And that's the uncomfortable part.

Security decisions are often based on visible consequences. The laptop worked yesterday. So why replace it? Nobody has complained about the shared login.

So why change it? We haven't had ransomware. So why spend money on that? Nobody has emptied the bank account.

So MFA can wait. Until you actually find something. And suddenly the conversation changes. Has it changed with them?

It has certainly made the discussion rather less theoretical. I bet. And I don't take any pleasure in that. Really?

Well, no. Fine. There's a very small part of me that wants to print last week's episode transcript, roll it into a tube and gently tap someone on the head with it. Gently.

Compliance requires proportionality. Of course. But seriously, nobody wants to be proved right this way. I'd much rather have been wrong.

I'd much rather the annual check had come back clean and we'd continued arguing about controls as a theoretical exercise. Because the whole job is preventing the interesting story. Exactly. Good IT is frequently incredibly boring.

Let's take the password exposure out of it for a second. Why did the shared account make this finding more difficult? Because identity is supposed to answer a very basic question. Who are you?

And their answer was, several people. Exactly. Imagine we're reviewing sign-in logs from months ago and we find something odd. An unexpected location.

Or a strange device. A login at an unusual time. A suspicious download. Whatever.

You look at the username. And it tells us which shared identity was used. Not which human. Correct.

Could you infer it from other evidence? Sometimes. Device records, IP addresses, working patterns, other logs. You can investigate.

But now you're doing detective work to reconstruct something the identity system should have told you in the first place. Exactly. You've voluntarily thrown away the cleanest answer. Yes.

And that's what annoyed me about this setup before we found the exposed credential. Now it's worse. Much worse. because if a password is known by six legitimate users and also appears in compromised credential data, you've created an attribution problem you simply didn't need to have.

You can't look at a successful password sign-in and immediately know whether it was Alice, Bob or someone in a basement 3,000 miles away. Precisely. Fred strikes again. Fred is incredibly productive.

Fred also appears to be working 24 hours a day. Employee of the decade. Here's the obvious pushback though. A password appearing in a dump doesn't automatically get somebody into Microsoft 365.

Correct. MFA exists. Yep. Conditional access exists.

Yep. Device controls exist. Yep. Risk-based sign-in controls exist.

Yep. So isn't the right response to say the password exposure is unfortunate, but the other layers should protect you? That's exactly the right response if the other layers exist, are configured properly, and actually apply to the account. And if the account is privileged, I want to know those controls are stronger than whatever happens to be convenient for everyone else.

Exactly. Ah. There it's again. Prove it.

Not we think it was switched on. Prove it. Which is why Microsoft now recommends phishing-resistant MFA for privileged administrative roles. Yes, and that's an important evolution.

Not just has MFA, but what kind and is it enforced? Microsoft explicitly recommends phishing-resistant methods for administrators, pass keys, FIDO2 security keys, Windows Hello and the other methods that can satisfy that stronger authentication requirement. And conditional access can actually enforce that requirement. Correct.

So the conversation isn't, we've told everyone to use MFA. It's, this administrative role can't get in unless this requirement is satisfied. That's a control. As opposed to hope.

Or an email sent to the staff 18 months ago. Which three people read? One of whom was on leave. This brings us back to the accountancy practice from the last episode.

It does. Because the contrast has become even more stark now. Yep, they're not perfect. I'll keep saying that because I don't want this turning into saintly accountants versus terrible professionals.

Saintly accountants sounds like a terrible ITV drama. Sunday nights after the antiques programme. But they've been responsive. That's the difference.

We explained that we want the team on Microsoft 365 Business Premium because we want the management and security capabilities. Fine. We explain conditional access. Fine.

We start moving authentication towards passkeys. Fine. Cyber Essentials is next. They still ask what things cost.

Of course they do. They still occasionally ask whether something really needs doing. As they should. I want customers asking those questions.

But once they understand the reason, the work moves. Exactly. Which matters because security work is never frictionless. Nobody is asking businesses to love licensing changes or device enrolment.

They just have to stop treating every basic control as a personal insult. Pretty much. And now we've the other organisation, where the reason for all these controls has effectively arrived in a data dump. That's what makes this so frustrating.

Individual accounts weren't an MSP preference. MFA wasn't us trying to sell another widget. Modern supported devices weren't an aesthetic choice. They were controls against actual risks.

Yes. Real ones. Boring ones. Predictable ones.

There are definitely people listening to this now, thinking, right, how the hell do I find out whether our credentials have leaked? Yep. And you're still making them wait. Absolutely.

Cruel. We've ten scans. We'll explain how to get one before we finish. Fine.

Carry on frightening everyone. Very reassuring programme this week. So let's close the loop. Governance.

Who owns the decision? Who decided shared identities were acceptable? Who accepted the risk? Who had authority to change it?

Exactly. Risk. What happens if that shared credential is exposed? We now know that one wasn't hypothetical.

Correct. Compliance. Show me that the controls you claim protect the account are actually there. Not the policy, the actual control.

And then reality. Somebody checks the credential exposure data and finds the password. That's quite a neat ending to a four-part series. I wish we'd made it up.

That's the problem with real-world examples. The writers get carried away. Bloody users. But this does change the conclusion from last week.

How? Last week we said compliance was about proving you weren't just making things up. Yep. This week suggests something slightly harsher.

Go on. Reality doesn't care whether you've completed the spreadsheet. No, reality will audit you for free. Usually at the least convenient possible moment.

And with considerably worse customer service. There's a problem though. I knew this was going too well. Only one?

We've just spent four episodes telling businesses to be clear about who makes decisions, understand their risks, put controls around things and be able to produce evidence. Yes. We've also spent a fairly large amount of time criticising organisations that say, trust us, it's fine. Quite enthusiastically.

Also yes. So perhaps we should stop saying, trust us, it's fine. About? This.

The podcast. Ah. Because there's something about how this programme is produced that we've never actually said out loud. That's true.

And before anyone assumes this is where Noel admits the whole show is three laptops in a trench coat, it's slightly more interesting than that. Given everything we've just spent four episodes saying about transparency and evidence. We probably should Probably That sounded suspiciously like resistance to a control Fine, we should The voice you're hearing right now is generated using AI. So is mine.

And mine. Which means I'm currently listening to an AI version of me explain that the AI version of me is AI. Correct. And I approved this?

You did. Good. Just checking governance. And before half the audience starts checking whether the last four years of their life have been a simulation, let's explain that properly.

Please. Noel and I've real conversations. The team has real conference calls. The arguments happen.

The terrible jokes happen. Sadly. The tangents definitely happen. Mostly you.

Bollocks. Strong counter-argument. Those conversations are the raw material for the programme. They get edited.

Tangents come out. Sometimes one conversation produces several episodes. Sometimes part of one discussion belongs in another episode entirely. Which isn't actually very different from conventional radio or podcast editing.

No. But here's the bit we haven't told you. Once the script is assembled and everyone involved has reviewed what they're being attributed as saying, the finished program is revoiced using consistent AI voice models. Clones of our voices with consent from the people whose voices are being used.

So the voice you hear as Null is based on Null. The slightly less knackered edition. The voice you hear as Lucy is based on Lucy. With substantially fewer accidental swear words.

I think the evidence would challenge that. Fair. Now, here's where it gets interesting. Do you rewrite what people say?

Not unless the contributor asks for something to be changed. We tidy, we remove repetition, fix transcription errors, we remove tangents, we can rearrange material into a coherent episode, but contributors get a say in the finished script before their voice is rendered. We also fix heteronyms as the AI sometimes has issues with those, so we may need to get the thesaurus out, but again, it's approved. Graham is the worst culprit here.

So, dear listener, I can confirm that I approve every tweak that my dulcet accent causes the tools. So if I look at the script and say, that's technically what I said, but you've changed the context and now it sounds like I meant something else. We fix it. If Graham says, I explained that terribly, let me change the wording.

We change it. If somebody simply doesn't want something they said on the conference call going out. It doesn't go out. And you don't ask an AI system to generate a controversial opinion for somebody because the episode needs a better argument.

Absolutely not. So if the system decides I'd probably have said something cleverer than I actually did, tough. Tragically, yes. Strong guardrail.

Personally devastating. Which feels like an important line. It's a very important line. What about factual claims?

We use AI in research and fact-checking, but it doesn't get the final word merely because it sounds confident. Claims and advice get checked again as part of the final production process. So AI is in the research pipeline. Yes.

It's in post-production. Heavily. It's in the voice production. Obviously.

But the human contributor retains control over what the programme attributes to them. That's the guardrail. There's one voice on the programme where the process is deliberately different. Ah yes, Moven.

Moven contributes to the programme with the knowledge of their employer, but their employer requires their identity to remain protected. So the voice you hear from Moven is deliberately not their real voice. That isn't us trying to make Moven more dramatic. Moven manages that perfectly well without assistance.

It's an identity protection control. Exactly. Their contribution is real. Their involvement is known.

the voice is intentionally disguised. Which is actually an interesting example of AI doing the opposite of impersonation. Yes. The same broad technology that can be used to imitate someone's identity can also be used to protect one.

Depending on the governance around it. There we're again. So here's the slightly uncomfortable question. Should we've told listeners about the voice production before now?

I think so. You do? Yes. Not because I think we've been secretly manufacturing people's opinions.

We haven't. Not because the contributors don't know. They do. Not because the voices are being used without permission.

They're not. But because disclosure is itself part of trust. Exactly. Somebody listening might say, I don't care.

I assumed half of podcasting was processed to death anyway. Fair. Because it damn well is, in fact, any podcast, audio or video that was recorded using off-the-shelf tools like Steamyard and Riverside are automatically processed far more than our in-house tools do. Somebody else might say, hang on, I've listened to all of you for months and I thought I was hearing the literal recording of the conversation.

Also fair. Naive but fair. And they're entitled to ask why we didn't make the production method clearer before now. Which is why we're saying it plainly now.

And somebody else might ask whether an AI-revoiced conversation is still authentic. That's the really interesting question. Because the conversation happened. The people said the things.

The contributors approved the finished version. But the sound wave coming out of your speaker was generated later. Is that still me? I think it is.

Of course you do. You run the production system. That does weaken my independence slightly. Let's push it.

Suppose I say a sentence badly on the conference call and ask you to tidy it before production. Fine. Still me? Yes.

You remove 20 minutes where we've wandered off into a completely unrelated argument about printers. Public service. Still our conversation? Yes.

One call produces three episodes. Still us. You take something I said in that conversation and put it into a different episode where it makes sense. Provided the context remains honest and you approve it, yes.

You ask AI what Lucy would probably say next. Generate the line and publish it in my voice without asking me. No. Same for me.

Same for everyone. Why? Because now I've crossed the line from production into impersonation. Even if I probably would have said it?

Doesn't matter. Even if it's harmless? Still doesn't matter. Even if it's funnier than what I actually said?

Painful, but no. So that's one of your guardrails? Absolutely. The voice model isn't permission to invent the person.

Which brings us back, annoyingly neatly, to GRC. It does. Governance. Who decides how AI is used in production?

We do, under rules the contributors know and agree to. Risk. What could go wrong? Misrepresentation.

Incorrect information. A voice being used outside its intended purpose. Context being changed. A contributor losing control of their own words.

Identity exposure. Plenty. Compliance. What controls exist?

Consent. Contributor review, editorial approval, fact-checking, defined boundaries around what can be changed, strong restrictions on voice use, extra protection where somebody's identity needs to remain private. And if one of us objects to something attributed to us. It changes or it doesn't go out.

And evidence? The source conversations exist. The scripts exist. The review process exists.

The production trail exists. So you're confident? Oh, fuck off. Come on, 94%?

I think we need a green spreadsheet. I walked directly into that. You really did. We're not going to pretend we've answered the AI question in the last third of a cyber security episode.

Not even close. Because once you start asking where that line sits, the questions get uncomfortable very quickly. What happens to a voice model when somebody leaves? Who owns it?

Who can use it? Can consent be withdrawn? What do you retain? What happens if a model or provider is compromised?

When should AI use be disclosed? When does editing become authorship? When does automation become impersonation? And how do you stop a perfectly reasonable AI policy turning into another spreadsheet where everything is green because nobody checked?

More importantly, what happens when the policy meets an actual production deadline and everyone suddenly wants an exception? Which sounds suspiciously like another episode. It does. The funny thing is, we've very strong guardrails around AI production already.

So next week, we're going to show you them. And then try to break them. Within the guardrails. That sounds much less fun.

Much more compliant, though. before we finish this four-part grc series let's go back to the business that started today's episode the password the credential appeared in compromise data, That doesn't prove somebody accessed the tenant. Correct. It doesn't prove a breach.

Correct. But it does prove that treating an important shared password as though it remained safely inside the business was no longer an assumption anyone should rely on. Exactly. However, not having shared the password in the first place would have been even better.

And because the identity was shared, the business had already weakened its ability to answer the most basic question if something suspicious did appear in the logs. Who did it? Governance tells you who owns the decision. Risk asks what happens when the decision goes wrong Compliance asks whether the controls you claim to have actually exist.

And reality eventually checks you're working Sometimes during a routine annual review. Sometimes during an audit Sometimes because an insurer asks. Sometimes because a customer asks And sometimes because somebody finds your admin password in a dark web dump. Which isn't the moment to start arguing about whether MFA is really necessary 11 months late for that meeting.

Quite. So if you're listening to this and thinking, nothing bad has happened to us. Ask yourself a different question. What evidence have you got nothing bad has happened?

And if the answer is, well, we'd probably know. 94% confident. I really hate you. Right.

You've been dangling something over everyone since the beginning. I have. Pay it off. We've got 10 dark web scans to give away.

10 scans. Free. Yep. If you subscribe to the newsletter on LinkedIn or Substack, we'll give you the details on how to claim one.

And let's be very clear about what a scan does and doesn't tell you. Absolutely. If we find exposed credentials associated with your business, we'll tell you what we found and explain what it means. If we don't find anything, we'll tell you that too.

But no result doesn't magically prove you've never had a problem. Correct. It's another piece of evidence, not a certificate of immortality. How much?

Free. What's the catch? There isn't one other than people are still listening yeah i know mildly cynical That's suspicious good The last four episodes have finally worked. And this isn't one of those free scans where somebody spends the next six weeks trying to sell you a 40 grand security project.

No. If there's something you need to fix, we'll tell you. If there isn't, we'll tell you that. So how do people get one?

Subscribe to the newsletter on LinkedIn or Substack. The claim details will be there. There are 10. Once they're gone, they're gone.

Which seems fitting after an episode about checking whether the thing you assumed was safe actually was. Exactly. And next week... We're turning the questions back on ourselves.

AI governance. The guardrails we actually use. What AI is allowed to do. What it's absolutely not allowed to do.

And whether those rules survive when we deliberately try to break them. That should be relaxing. That's governance, risk and compliance done then. Four episodes.

Nobody got audited live on air. Give it time. We survived. Your password might not have.

See you all next time. Right, before we let you go completely, let's have a quick chat about the boring but necessary legal bits. Don't worry, I'll make this as painless as possible. First up, and this is important, everything we've said today represents our own personal opinions and experiences.

These views are ours alone and don't represent any organisation we work for, any employers, advertisers, sponsors, or anyone else who might be connected to the show. When we're giving you advice or sharing our thoughts, that's coming from us as individuals, not speaking on behalf of anyone else. Everything we've talked about today is for general guidance. It's meant to point you in the right direction, but it absolutely shouldn't be treated as professional advice tailored specifically to your business.

Your situation is unique. What works brilliantly for a Birmingham bakery might be completely useless for a Manchester marketing agency. We do our very best to keep everything accurate and current, but let's be honest here. The cyber security world moves faster than a caffeinated squirrel being chased up a tree by Marvin's Jack Russell.

Things can change between when we record and when you're listening, so always double-check critical technical details with qualified professionals before you go making major changes to your systems. If we've mentioned any websites, products or services, we're giving you information, not necessarily giving them our seal of approval. We can't be responsible for what happens on their end or if things go sideways when you use them. Some things we recommend might involve affiliate partnerships.

We'll always flag those when they come up because transparency matters. Now, if you're dealing with serious cybersecurity incidents, actual data breaches, or gnarly legal compliance issues, please talk to proper professionals, rather than just relying on podcast advice. We're here to educate and help you understand the landscape, not to replace your security consultant, solicitor, or IT team. This has been a Small Business Cybersecurity Guy production, copyright 2025, all rights reserved.