Passwords and sign-ins
How one reused password can open everything
You might never have been hacked. A website you once signed up for probably has been, and your password from it may be on a list.
1 min readExplainer
The short version
When a website is breached, attackers try the leaked passwords on every other service. Reused passwords make that work.
How it works
Large websites are breached regularly, and the stolen lists of emails and passwords are sold and shared. Attackers load these lists into software that tries each pair against email providers, banks, Microsoft 365 and other popular services, automatically and at enormous scale. This is called credential stuffing.
It works because so many people reuse passwords. If your work email and the password you used for an old shopping site match, the shopping site’s breach becomes your company’s breach.
Signs it may have happened
- A sign-in alert or multi-factor prompt you did not expect.
- A password reset email you did not ask for.
- Being told by a service that your password appeared in a breach.
What to do
- Use a different password for every account. A password manager makes this practical.
- Never use your work password anywhere else.
- Turn on multi-factor authentication, so a leaked password alone is not enough.
- Change any password you have reused, starting with email and banking.
- Check whether your email address appears in known breaches. Free breach notification services can tell you.
Talk to us about your technology
Tell us what you run today and what is getting in the way. We will get back to you about how we can help.