Password reuse

How it works

People reuse passwords because remembering dozens is hard. The risk comes from the way breaches work. A service loses its database, the attacker gets the email and password, and then tries the same pair on other sites. CISA tells the story of Emma, who used the same password for her email and her bank account. That password was part of a company breach posted online, and an attacker took over both accounts.

OWASP cites a real case. After the 2011 Sony breach, an analysis found that two thirds of users whose data was in both the Sony and the earlier Gawker breach had used the same password on each system.

How it shows up in executive exposure

Executives often have many accounts across work and private life, and long histories of registrations. If the same password sits behind an old forum account and a current business mailbox, a breach of the forum is enough. MITRE describes credential stuffing as using credentials from breach dumps of unrelated accounts to reach target accounts through credential overlap, and says it exploits the habit of reusing passwords across personal and business accounts.

WebThreat's CEM treats likely password reuse as a ranking factor: when a password is exposed and the person appears in more than three breaches, the person moves further up the list. The flag marks likely reuse, so the affected leader resets first. See the methodology.

How to reduce the risk

• Use a unique password for each account. CISA recommends a password manager for this.
• Enable multi-factor authentication, especially on email, social and financial accounts.
• After any breach notice, change the exposed password and every account that shared it.
• Check new passwords against lists of known breached passwords where you control the login.

How it differs from related terms

Password reuse is a habit. Credential stuffing is the attack that exploits it. A credential pair is the data that gets replayed. Account takeover is the outcome when the replay succeeds. For the response steps, read what to do when an executive's password is in a breach.