How a password ends up in a breach
A password rarely leaks because of you. It leaks because a service where you had opened an account was hacked. A forum, an online shop, an invoicing tool, a booking platform: in every case, the attacker walks away with the database of accounts.
This database contains e-mail addresses and passwords. The latter are normally stored as a fingerprint, not in plain text. But many services still use outdated storage methods that make it possible to recover the original password within hours using ordinary equipment. Once reconstructed, these passwords are resold, then end up circulating for free in compilations of several billion lines.
That is why the question is not whether you chose your password well, but whether it has already been exposed elsewhere. You have no control over the security of the services you trust with an account, and you are generally not informed of the hack, or only months later.
What an attacker does with a stolen password
A single password interests no one. What interests the attacker is the pairing of e-mail address and password, multiplied by millions. They use it for an attack called credential stuffing.
The principle is mechanical. The attacker takes the list of pairs stolen from one site and tries them automatically on hundreds of other services: e-mail accounts, online banking, social networks, professional tools, corporate remote access. A program tests thousands of combinations per minute, spread across many addresses so as not to trigger alerts.
The success rate is low, often below 1%. But out of ten million pairs tested, that represents tens of thousands of accounts opened, at almost no cost. There is no targeting, no expertise, no relentless campaign against your company in particular: you are simply a line in a file. That is also why a small organisation is just as concerned as a large group.
When the account opened is a work e-mail, what follows is well known. The attacker reads the correspondence, learns how the company operates, then diverts a payment or sends altered invoices to your clients. Our article on e-mail account compromise details this scenario, which almost always starts with a reused password.
Why reuse is the real danger
Credential stuffing only works thanks to one universal habit: using the same password in several places. Without that habit, a forum breach would remain a problem confined to that forum.
A unique password per service turns each breach into an isolated incident. A password reused across ten services turns the same breach into the compromise of ten accounts. The quality of the password changes nothing in this mechanism: a long, complex phrase reused everywhere is more dangerous than a mediocre but unique password, because once it is exposed it opens all the doors at once.
Variants do not protect you either. Adding the site name at the end, incrementing a digit or replacing letters with numbers are patterns that attack tools test automatically. A human who looks at two of your passwords can usually guess the others.
The only realistic answer is a password manager. It generates a different password for each service, remembers them for you, and flags those that have leaked. You only need to memorise a single password, that of the manager, which must be long and protected by two-factor authentication.
What to do if your password is found
A password present in the database must be considered public. It is not about tweaking it slightly, but about replacing it everywhere, in this order of priority.
- Your main e-mail account first. It is the one that lets you reset all your other accounts. As long as it is exposed, securing the rest is pointless.
- Financial access. Online banking, payment platforms, accounting software, payroll portal.
- Business tools and remote access. Management software, online storage, remote access to the company network.
- All other services where this password, or a variant, may have been used.
Then enable two-factor authentication everywhere it is offered. It makes a stolen password insufficient on its own, and neutralises credential stuffing even if your credentials are already in circulation. Finally, check the recent activity of your accounts: unusual logins, unknown devices, automatic forwarding rules created in your mailbox. If you suspect actual access, our file on data theft describes the possible consequences and your notification obligations.
k-anonymity, explained simply
There remains the question that legitimately blocks everyone: how can you check a password without disclosing it? The solution is called k-anonymity, and it rests on a simple idea, hiding in the crowd.
Your browser starts by computing a fingerprint of the password. A fingerprint is a string of 40 characters produced by a one-way calculation: the same password always gives the same fingerprint, but it is impossible to work back from the fingerprint to the password.
Instead of sending this fingerprint, the tool transmits only its first five characters. The queried server then returns the complete list of known fingerprints that begin with those five characters, typically several hundred results. Your browser receives this list and searches it itself for the end of your fingerprint.
The decisive comparison therefore takes place on your device, never elsewhere. The server knows that a visitor is interested in a group of several hundred possible passwords, with no way to know which one, nor even whether the result was positive. It is this property, and not a contractual commitment, that makes the operation safe.
To place your company's level of protection in a broader context, the cyber check-up covers, in twelve questions, the measures that truly matter, and the Tools page brings together our free resources.