Founders who've had credentials leak in a breach: how did you actually find out?

Genuine question for the room.

If an employee's work email and password have ever been part of a breach that wasn't yours, how did you first hear about it? Was it something you'd set up in advance and got an alert from, or did a customer flag something odd, or did you only work it out after an actual incident? I've also seen cases where founders only stumbled across it months later by accident.

I'm trying to get a clearer picture of how this problem actually surfaces for small teams. The version in vendor whitepapers always feels a bit too tidy compared to what I hear when I ask people directly.