Why reusing passwords is still one of the biggest security risks.

The Australian Signals Directorate’s handbook for small business says weak or reused passwords are a common cause of cyber security incidents. The advice against reuse is old, and most people have heard it. It is still in the handbook because the habit is still common, and because of what it does: it puts the security of your email account in the hands of whichever website you signed up to in 2017 and forgot about.

How one stolen password opens several accounts

Websites get breached, and when they do, lists of email addresses and passwords get out. The Australian Signals Directorate (ASD) reports that criminals buy stolen usernames and passwords on the dark web and use them to get into email, social media and financial accounts. Nobody types them in by hand. Software tries each stolen pair on other services, one after another, a technique called credential stuffing. Google has said that most of the account hijacking attempts it sees come from automated bots working from other companies’ password breaches.

If the password was used once, the damage stops at the site that lost it. If the same password also opens your mailbox, the accounting system and the bank, they are all exposed at the same moment, and none of them did anything wrong. ASD lists this among the ordinary ways an account is compromised: another account with the same password was compromised first.

A small change does not make it a new password

Many people know they should not reuse a password and settle for a variation: the same word with a different number, or the name of the site added to the end. Have I Been Pwned, the service that tracks breached passwords, warns that attackers can easily predict these common patterns. If Winter2025 has leaked, Winter2026 is an easy guess.

Passwords also leak from your own devices

A breach at someone else’s website is one source. Another is malware known as an information stealer, which ASD describes as software built to collect usernames, passwords and browser data from an infected device and send it to criminals. It arrives through phishing messages, malicious advertisements and downloads.

ASD’s 2024-25 threat report includes a case that shows how work and home get mixed. An employee of a utility company signed in to a personal Google account on a work computer, and the browser probably synced their saved work passwords to that account. Later their personal device was infected with an information stealer, which pulled the work passwords out of the browser. The company told ASD this has become an increasingly common problem.

Nothing in that case involved reuse. It is here because it shows a work password leaking without the business itself being breached, which is the reason each password should open only one account.

Why it costs a business more

For a person, a reused password might mean a hijacked social media account. For a business, the password that leaks is often the one for email, and email is where password reset links for everything else arrive. ASD notes that once someone is in an account they can change the password and lock the owner out. Of the more serious incidents reported to ASD in 2024-25, 42% involved compromised accounts or credentials.

What to do instead

Keeping track of dozens of different passwords is hard, and ASD says so. Its answer is a password manager.

1. Give everyone a password manager. ASD recommends one because it creates long, unpredictable and unique passwords and fills them in for you. Staff then have one password to remember.
2. Protect the password manager itself with a long master password that is used nowhere else, and with multi-factor authentication.
3. Start with email, banking and accounting. Change any password that is used in more than one place. Some password managers flag weak, reused and leaked passwords, which makes the list easy to find.
4. Where an account cannot use multi-factor authentication, make its password at least 15 characters. ASD suggests a random mix of unrelated words.
5. Turn on multi-factor authentication everywhere it is offered, so that a password that does leak is not enough to sign in.
6. Use a passkey where a service offers one. A passkey signs you in without a password for that account, so there is nothing to reuse and nothing to type into a fake website.
7. Keep work passwords in the work password manager, and out of personal browsers and personal accounts.

Two old rules worth dropping

Some businesses still make staff change their passwords every 60 or 90 days. The current guidelines from the US National Institute of Standards and Technology (NIST) say organisations must not require periodic changes, and must force a change when there is evidence a password has been compromised. ASD’s advice is the same: change a password if you think it has leaked.

The second rule is any policy, or any website, that stops people pasting a password or using a password manager. NIST says services should allow both. If your own business runs a customer login, the same guidelines say new passwords should be checked against lists of passwords known to have been breached.

Unique passwords and a second step at sign-in work together. Our lesson Multi-factor authentication: what it is and where to start covers the second half. If you would like the password manager, MFA and passkeys set up across the business, that is part of Identity & Access Management.