What happens when your password is stolen?
getty
Now that World Password Day has been and gone, credential theft will continue as before. Infostealers will continue stealing, hackers will continue compromising, and accounts will be raided for whatever value they contain. But have you ever stopped to think what actually happens after your password gets stolen? The security boffins at Comparitech, after analyzing more than 447,000 credential “leaks, dumps, and breach threads” across four cybercriminal forums containing a total of 1.1 million stolen user records dating from 2013 to 2026, have revealed the answer.
If you have ever found yourself in the nightmare scenario where the password to one of your accounts has been compromised, you will know all too well the sense of panic and hopelessness that immediately washes over you. And, sad to say, the chances are pretty high that you have. I recently reported that password theft had surged across 2025 with 2.8 billion credentials found to be compromised. With newly published warnings that Microsoft Edge loads your passwords in plain text in the browser process memory, and Amazon being weaponized with the use of stolen credentials, the new Comparitech analysis could not have come at a better time. Taking the format of a statistical analysis of the dark web’s credential pipeline, the report answers the question: Where do leaked passwords end up?
According to Paul Bischoff, author of the report write-up for Comparitech, the researchers, including Mantas Sasnauskas, analyzed databases from four major cybercrime forums to uncover just how stolen passwords are “accessed, traded, and aggregated before being utilized in credential-stuffing campaigns, ransomware attacks, business email compromise, and so on.”
Although a five-stage password supply chain was composed as a result of the analysis, the first stage, origin, is a moot point, as it involves things that have already happened before the credentials arrive on a cybercrime forum. What we do know is that infostealer malware and data breaches are the primary sources of compromise.As, indeed, is the last: end use details what the credentials will be used for in the future, such as breaches, ransomware and so on. The remaining middle stages, defined as wholesale, trade and aggregation, provide the heart of the analysis.
MORE FOR YOU
Wholesale is where the stolen passwords are brokered, perfectly demonstrating the supply side of the password economy. One Russian-language cybercrime forum, RAMP, for example, was selling pre-authenticated initial access to corporate networks using stolen credentials.
Next up is trade, where, unsurprisingly, “compromised data is posted, sold, traded, and reposted across hacker forums, both as free downloads and inside paid marketplaces,” Bischoff said.
Then comes aggregation with compromised passwords and other credentials being fed into so-called combolists, the most valuable of which have been deduplicated across the breaches concerned, which hold value for attackers. The reason? Because they can be used to leverage credential-stuffing threat campaigns.
With the Comparitech analysis providing the answers to what happens after your password has been compromised, one question remains hanging in the cyber wind: how can you protect it from being stolen in the first place? The simple answer is by not using one to start with. Switch to passkeys wherever possible, as these are way more secure and much, much harder to compromise. Apart from that, never share your password between sites and services, as this leaves them all vulnerable if just one is breached. Use a password manager for your password and passkey needs. This will allow you to use strong and unique passwords without needing to remember them all. Also, always employ two-factor authentication where available, as this adds another layer between your account and anyone in possession of your stolen password.
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。