Breached website detection and notification

A network security system comprising:

• a non-transitory storage device having embodied therein one or more routines operable to alert a user of a client device associated with a private network of an enterprise of security breaches relating to websites the user visits;
• and
• one or more processors coupled to the non-transitory storage device and operable to execute the one or more routines to perform a method comprising:
• intercepting, by a network security device protecting the private network, information associated with an interaction with a website by a browser of the client device;
• based on the information, proactively determining, by the network security device, whether the website or a domain with which the website is associated has been a subject of a security breach by querying a cloud-based security service that actively maintains a list of breached websites;
• and
• when said determining is affirmative, then causing, by the network security device, the user to be notified regarding the security breach involving the domain or the website by issuing a replacement Hypertext Transfer Protocol (HTTP) response message to the browser;
• monitoring, by an endpoint security solution running on the client device, inputs by the user on login portals of public websites;
• precluding the user from reusing passwords across public and intranet domains by comparing, by the endpoint security solution, the inputs to one or more user passwords for enterprise accounts of the user;
• when said comparing results in detection of a match between a password for a particular public website and a password of a particular enterprise service, then:
• causing, by the network security device, the user to reset the password for the particular public website by causing the browser to be redirected to a password change portal associated with the public website;
• and
• causing, by the network security device, the user to reset the password for the particular enterprise service by causing the browser to be redirected to a password portal associated with the particular enterprise service.

A non-transitory media strong computer-readable source code that, when executed by a processor, performs a method comprising:

• intercepting, by a network security device protecting a private network of an enterprise, information associated with an interaction with a website by a browser of a client device associated with the private network;
• based on the information, proactively determining, by the network security device, whether the website or a domain with which the website is associated has been a subject of a security breach by querying a cloud-based security service that actively maintains a list of breached websites;
• and
• when said determining is affirmative, then causing, by the network security device, the user to be notified regarding the security breach involving the domain or the website by issuing a replacement Hypertext Transfer Protocol (HTTP) response message to the browser;
• monitoring, by an endpoint security solution running on the client device, inputs by the user on login portals of public websites;
• precluding the user from reusing passwords across public and intranet domains by comparing, by the endpoint security solution, the inputs to one or more user passwords for enterprise accounts of the user;
• when said comparing results in detection of a match between a password for a particular public website and a password of a particular enterprise service, then:
• causing, by the network security device, the user to reset the password for the particular public website by causing the browser to be redirected to a password change portal associated with the public website;
• and
• causing, by the network security device, the user to reset the password for the particular enterprise service by causing the browser to be redirected to a password portal associated with the particular enterprise service.