Handling a credential exposure report at work — what should I ask my security team?

Oh man! Ad-blocking software has been detected! :'(

This website is run by the community, for the community... and it needs advertisements in order to keep running. Blocking our ads means your killing our stats!
Please disable your ad-block, or become a premium member to hide all advertisements and this notice.

I work in IT support in South Carolina, and our security team recently told us about a third-party service provider credential exposure that may affect some internal accounts. I'm not on the security side myself, just trying to understand what a reasonable follow-up looks like from an admin/helpdesk perspective.

What I'm unsure about is how far this kind of exposure usually reaches — if a vendor reports that credentials for its users were exposed, does that typically mean just the vendor login, or could linked SSO or reused passwords be involved too? I don't want to assume the worst, but I also don't want to brush it off.

For those who've dealt with vendor breach notifications before, what questions do you ask internally? Password resets, MFA checks, monitoring? And how do you tell users without causing panic?

Appreciate any input from people who've been through this.