Why password breaches never seem to stop

The short version

Password breaches feel like a scratched record: a site falls, millions of credentials circulate, you change one password… and six months later, same story. That is not (only) because “people are careless.” It is because several systems reinforce each other: stolen databases that stay useful for years, passwords reused across services, cheap automated attacks, and an authentication model still too often reduced to a string of characters.

The good news: we know what actually cuts risk. The bad news: it is not a single alert or a magic VPN. It is slightly boring hygiene — and, increasingly, passkeys (passwordless sign-in keys).

What a “password breach” really is

Under one headline, several realities get mixed:

1. Database theft at a service (intrusion, bad storage, misconfiguration).
2. Reuse: the same email + password pair works elsewhere.
3. Credential stuffing (automated reuse of stolen logins): bots test stolen lists against thousands of sites.
4. Phishing: you type the password yourself on a fake site — sometimes with no spectacular initial dump.
5. Malware / keyloggers: local theft, often invisible in big headlines.

Media coverage often focuses on point 1. Your email or bank account is often compromised via points 2, 3, or 4. That is why it “never stops”: even when one site cleans up, the recycled-credential ecosystem keeps running.

Why it continues: the recycling economy

A breach is not a disposable event. Lists circulate, merge, get resold, become “combo” files (email:password). Years later, a forgotten forum password from 2017 can still open a 2026 shopping account — if you reused it.

Breach investigation summaries (such as Verizon’s DBIR tradition) have long pointed to a cold fact: a huge share of intrusions involve valid credentials (stolen, phished, or weak), not a cinematic exploit. Attacking with a real login is cheaper than finding a zero-day (a flaw unknown to the vendor).

On the defender side, the cost of storing passwords well (modern hashing, salting, rate limiting — capping how many tries you get —, stuffing detection) varies by company. On the attacker side, replaying a list is cheap. The asymmetry is structural.

The reuse trap (stronger than “complexity”)

For years the mantra was: uppercase, number, special character. Useful… until Sophie2019! is reused everywhere. Modern guidance (including the spirit of NIST digital identity guidelines) emphasizes:

• length and uniqueness;
• rejecting passwords already known to be compromised;
• dropping absurd rules that push predictable variants (Summer2024!, Summer2025!).

The real killer feature of a password manager is not “generate xK9$….” It is making uniqueness the default: a different secret per site, without impossible human memory.

Without that, every new breach is not an isolated incident. It is a master key wandering around.

Credential stuffing: the industrial everyday attack

Credential stuffing (OWASP) is simple in concept:

1. Obtain millions of email/password pairs from breaches.
2. Test them automatically against Netflix, Amazon, banks, webmail, games, work tools…
3. Keep what works (even a small hit rate can be profitable).
4. Monetize: account resale, fraud, spam, pivot into other services.

Serious sites slow this down (CAPTCHA, attempt limits, IP detection, MFA — multi-factor / two-step authentication). But the ecosystem is vast: a forgotten app, an old forum, a poorly protected B2B SaaS (online business software), and the chain restarts.

You are not necessarily “targeted.” You are on a list.

What headlines get wrong

• “200 million passwords leaked” can mean duplicates, old hashes, aggregates of several incidents, or remixed known dumps.
• A service can truthfully say “no plaintext passwords” — and still leak emails/phones that make attacks elsewhere easier, or rely on weak hashing.
• Changing one password after one alert does not protect other accounts where you recycled the same secret.

Checking Have I Been Pwned remains a good reflex: not to panic, to prioritize.

What actually works (by impact)

1. A password manager + uniqueness

Pick one (browser/OS built-in, or dedicated), generate long secrets, never reuse. This is the measure that most often breaks the stuffing chain.

2. MFA everywhere it matters

Priority: primary email, bank, Apple/Google/Microsoft account, work tools. Prefer an authenticator app or hardware key over SMS when possible (SMS is better than nothing, with known limits).

3. Passkeys (when the site offers them)

Passkeys (FIDO) replace the typed secret with authentication tied to your device / biometrics / key manager. Major upside: a phishing site has a much harder time tricking you into “handing over” a passkey the way you hand over a password. Not universal yet, but the trajectory is clear: fewer stealable character strings means less raw material for the breach market.

4. Recovery email and phone numbers kept current

A locked account with an abandoned recovery mailbox is false security. The weak link is often the recovery account.

5. Hygiene after an incident

If a service notifies you of a breach:

1. change the password there;
2. change it everywhere you reused it (the painful part);
3. turn on MFA;
4. watch bank activity / suspicious purchases;
5. distrust fake “support” messages that arrive right after the news.

What helps little (or not the way people think)

• Rotating passwords every 30 days for no reason: often pushes weak variants. Change when there is real risk or doubt.
• A VPN (/en/tools/vpn): useful against other threats (hostile networks, some privacy uses), but it does not fix a reused password or a dump already stolen from a third party. Not the main fix here.
• One “very complex” password… reused: complexity ≠ isolation.
• Relying only on “I can remember it”: human memory does not scale to 80 accounts.

Why companies also never “finish” the problem

Even with guidance (NIST, CISA, OWASP practices), field reality stays uneven:

• technical debt and legacy systems;
• vendors and fuzzy perimeters;
• shared accounts / passwords in tickets;
• slow detection: exploitation can precede public disclosure;
• B2B users recycling the same personal/work secret.

So the problem is not only “educate people.” It is also shrinking the surface where one secret opens too many doors — which is why passkeys, MFA, and killing shared passwords matter.

A realistic checklist (not a fortress)

If you only do three things this week:

1. Install (or enable) a manager and migrate email + bank + Apple/Google first.
2. Turn on MFA on those accounts.
3. Check Have I Been Pwned for your main address, then clean up reuse.

Then, as you log in over time: replace old “one for everything” secrets with unique ones. Progressive, not heroic.

To pick the tool (free vs paid, sync, recovery): Password managers: what actually matters.

A 10-minute action plan

Set a timer. The goal isn’t perfection — it’s cutting the stuffing chain on your critical accounts.

1. Minutes 0–2 — Open Have I Been Pwned, check your main email. Note services where you reused the same secret.
2. Minutes 2–5 — Enable (or install) a manager. Change the primary mailbox password first → generate a unique secret, save it in the vault.
3. Minutes 5–8 — Same move for Apple / Google / Microsoft (the account that recovers everything else) + your bank or main payment method.
4. Minutes 8–10 — Turn on MFA (authenticator app preferred) on those three to four accounts. Screenshot the backup codes.

Tomorrow: every time you still use an old shared password, replace it. Within a week, most master-key doors are closed.

How to think about “another mega-leak” without spiraling

When the next dump hits the news, a useful filter is:

1. Is this new material or a remix? Aggregators often republish older combos under a fresh headline.
2. What data types leaked? Email + password hash is different from email + phone + partial card data.
3. Did you reuse that password? If yes, treat every other login sharing it as urgent — not only the breached brand.
4. Is your recovery path solid? Attackers often pivot through the mailbox, not the shopping site itself.

Fear is a poor allocator of effort. A one-hour migration of your top five accounts beats a week of anxious headline reading.

Going further

• Have I Been Pwned — see whether your email appears in known dumps.
• OWASP — Credential stuffing — how the automated attack works.
• NIST SP 800-63 — modern framing for digital identity and secrets.
• FIDO Alliance — Passkeys — the gradual replacement of passwords.
• Verizon DBIR — incident trends and the role of credentials.
• CISA — Secure our world — practical account security basics.