2 min read
Jason had a system. One strong password. He used it everywhere. His work email, his personal Gmail, his bank, his gym app, even the pizza delivery site he signed up for three years ago. He figured if the password was long enough, it was fine.
Then the pizza app got breached. He never heard about it. He never changed his password.
Three weeks later, someone logged into his personal Gmail. From there, they found an email with his work username. They tried the same password on his company's login page. It worked. By the time IT flagged the unusual sign-in, the attacker had spent two hours inside Jason's account.
Jason did not do anything obviously wrong. He just reused one password in one too many places.
What Happened
A third-party website Jason used was breached, exposing his email and password. Attackers took that combination and tried it on other sites automatically. This is called credential stuffing. Because Jason used the same password everywhere, one breach opened the door to everything.
When you reuse a password, you are only as secure as the weakest site that holds it. A breach at a food delivery app or a retail site can expose your work account, your bank, and your personal email. You may not even know a breach happened for months. By then, the damage is done.
Remember the Framework
Simple Steps to Protect Yourself
-
Use a unique password for every account. No exceptions for work accounts, email, or banking.
-
Use a password manager. It remembers every password for you, so you only need to remember one master password.
-
Turn on multi-factor authentication (MFA) wherever it is available. Even if a password is stolen, MFA can stop the attacker at the door.
-
Check if your email has appeared in a known breach. Visit haveibeenpwned.com. It is free, reputable, and takes 10 seconds.
-
If you find out your password was exposed anywhere, change it on every site where you used that same password. Do it the same day.
Do This Today
Pick one account you know you have reused a password on, and change it to something unique right now. If you use the same password for work and anything personal, change your work password today and report it to IT. Check haveibeenpwned.com with your work and personal email addresses.
Quick Checklist
-
Every account has its own unique password.
-
I use a password manager for work and personal accounts.
-
MFA is turned on for my work email and any account that supports it.
-
I have checked haveibeenpwned.com with my email addresses.
-
I know to report unusual account activity to IT immediately.
Zero Trust Human Habit of the Week
Never reuse a password. If one site gets breached, the damage stops there.