Credential Stuffing: Why a Password You Reused in 2019 Just Emptied Your Rewards Account

A break-in with no broken lock

Between 17 and 19 June 2026, attackers got into Chick-fil-A One accounts belonging to customers across several US states. They saw names, contact details, membership information, payment details, and partial card numbers. The company reset logins, stripped saved payment methods, and restored account balances.

The part that surprises people is that Chick-fil-A’s systems were never broken into. The attackers logged in. They had working usernames and passwords, and the website did what websites do when presented with correct credentials.

The credentials came from somewhere else. Some other company, possibly years ago, lost its user database. That list has been circulating ever since, and somebody eventually tried those email-and-password pairs against a fast food loyalty programme to see which ones still worked.

What credential stuffing actually is

Picture a burglar who has acquired ten thousand keys from a demolished apartment building. The keys are useless for that building. So the burglar walks down a street of houses trying every key in every door, on the theory that some people keep the same lock everywhere.

That is the whole attack. Attackers take username and password pairs from old breaches, then feed them into login forms at unrelated sites, automated, thousands per minute. The industry name for it is credential stuffing, and the success rate per attempt is low, somewhere between a fraction of a percent and a few percent. With a list of a hundred million credentials, a fraction of a percent is still hundreds of thousands of accounts.

The attack works for one reason: people reuse passwords. If every password you used were unique, a breach at one company would tell an attacker nothing about your accounts anywhere else. Reuse is what converts one company’s bad day into your problem at ten other companies.

The words that keep coming up

A short vocabulary stop before going further. Writing on this subject tends to use half a dozen terms interchangeably and define none of them, which is how people end up nodding along to advice they cannot act on.

Term	What it means in plain words
Breach	A company lost control of data it held about customers, usually a copy of its user database.
Credentials	The pair of things you type to sign in, normally an email address and a password.
Hash	A scrambled version of a password that a site stores instead of the password itself.
Combo list	A tidied file of email and password pairs gathered from many breaches, traded or sold, ready to be fed into a tool.
Credential stuffing	Trying stolen pairs against sites they never came from, at machine speed.
Brute force	Guessing a password by working through possibilities. A different attack, and the one the old password rules were written for.
Two-factor authentication	A second proof of identity on top of the password, usually a code or a tap on your phone. Written 2FA, or MFA when there might be more than two.
Authenticator app	A free app that produces a six-digit code which changes every thirty seconds.
Passkey	A replacement for the password, kept on your device and released by your fingerprint, face, or PIN.
Vault	The encrypted file where a password manager keeps your logins.
Master password	The one password you still have to remember, which opens the vault.
Account takeover	The result: somebody else signed in as you.

Hashing deserves a second look, because breach notices lean on it so heavily. When a company says the stolen passwords were encrypted, what it usually means is that the database held hashes rather than the passwords themselves. A hash is a one-way scramble, and you cannot run it backwards with mathematics.

You can run it forwards, though, millions of times a second, and that is the weakness. Older methods such as MD5 and SHA-1 were built to be fast, so an attacker with an ordinary graphics card can hash a dictionary of common passwords and look for matches. Anything short or predictable falls in seconds. Newer methods, bcrypt and scrypt and Argon2, are deliberately slow, which drops the attacker’s rate from billions of guesses per second to thousands.

There is a second ingredient called a salt: a random value mixed into each user’s password before hashing, so two people who chose the same password end up with different stored values. Without a salt, an attacker cracks a password once and immediately identifies everybody else who used it.

None of which you can check from the outside. The honest way to read a breach notice is to assume any password you ever used at that company is now known to somebody, and to act accordingly.

How one breach turns into six problems

Assume the worst about the hashing, then, and follow what the person holding the list does next. The path is more mechanical than dramatic.

Follow the branch through your webmail and you can see why email sits in a category of its own. Every other service on the internet offers to email you a reset link, so the inbox is a skeleton key even for accounts where your password was perfectly unique. Attackers know this, and one of the first things they do after getting in is create a mail rule that quietly files or deletes anything containing words like “password”, “security alert”, or the name of a bank, so the warnings you would otherwise notice never reach you.

The volume side of this deserves a sentence. Nobody types these attempts by hand. Tools take the list, spread requests across thousands of home internet connections so the traffic looks like ordinary customers scattered around the country, and grind through basic bot checks. Verizon’s analysis of enterprise sign-in logs put the median daily share of authentication attempts that looked like credential stuffing at around 19 percent, roughly one in five. Have I Been Pwned’s work with the Synthient credential dataset catalogued something on the order of two billion unique email addresses appearing in stuffing lists.

Those figures describe a background process rather than an event. Somewhere, right now, an old credential of yours is being tried against a site you have never visited.

Why a loyalty account is worth stealing

A reasonable reaction to all this is that a fast food account is not exactly a bank. That instinct undersells what these accounts hold.

They usually contain stored value: points, credits, a preloaded balance. That value can be spent, and it converts into food or gift cards which resell easily. Fraud teams see loyalty balances traded on the same markets as stolen card numbers, at a discount, because they are harder to trace.

They also contain a saved payment method. Attackers may not be able to read your full card number, and they very often can place orders with it, which is the same outcome from your bank statement’s point of view.

And they contain personal information that makes the next attack easier. Your name, address, phone number, and order history are the raw material for a convincing scam call. Somebody who can tell you your last three orders and the last four digits of your card sounds like they work there.

The Upbound Group disclosure from the same month shows where this leads. Attackers obtained customer information described as non-sensitive, then used those details to open fraudulent lease-to-own agreements through the company’s Acima business, producing roughly $13 million in losses in a single quarter. On its own the stolen data had little value. Its worth lay in supplying the ingredients for impersonation.

What could go wrong, in four ordinary evenings

Risk stated in the abstract is easy to shrug off, so here are four shapes this takes in practice. Fraud teams have shorthand for all four, which tells you how often they see them, and none of them require an unusual target.

The inbox goes first. Somebody signs into your webmail using a password you set years ago and used in three other places. They send nothing, because sending is what gets an account noticed. Instead they add a filter that deletes messages containing the word “password”, then start requesting resets at the shops, the streaming services, the phone company, and the bank. Your unique, generated, perfectly good bank password stops mattering, because the reset link lands in their hands. You find out on Thursday when a card is declined.

The phone number changes hands. Your name, address, date of birth, and the last four digits of a card all sat in a breach two years ago. Somebody walks into a phone shop, or calls a support line, and uses those details to report a lost handset and move your number onto a new SIM. Your phone shows no service, which you put down to the network, while everyone else in the house has signal. Every SMS code now arrives on a stranger’s device, including the codes protecting your bank. The tell is that sudden loss of service; the response is to call your carrier from another phone straight away; the prevention is a port-out PIN on your carrier account plus moving codes off SMS wherever an app is offered.

The balance is gone by Sunday lunchtime. A loyalty account holding a couple of hundred in stored value gets drained across a dozen small transactions, mostly gift cards, spread over a weekend when nobody is watching. No fraudulent card charge exists for a bank to reverse, because the money was already inside the company’s own system. Whether you get it back depends on the merchant’s goodwill and their fraud policy, which is a considerably weaker guarantee than card protection.

Somebody opens an account in your name. People underrate this one, and it is what the Upbound figures describe. Stolen personal details, none of them secret in isolation, get assembled into a credible identity and used to take out a financing agreement, a buy-now-pay-later account, or a mobile contract. You learn about it from a letter chasing payment, or from a credit check months later when you apply for something yourself. Cleaning it up takes correspondence rather than a phone call. The useful protections here are dull ones: put a freeze or a notice on your credit file, then read your credit report once a year.

What links all four is that the break-in was cheap while the damage happened downstream. Nobody picked you out. Your credentials sat on a list, somebody tried the list, and the rest ran on rails.

How to tell if this is happening to you

The warning signs are quiet, which is why these attacks run for days.

An email saying your password was changed, when you did not change it, is the clearest one and it needs action within minutes rather than hours. A notification of a login from a place you have never been is the same signal. So is a points balance that has dropped, an order in your history you did not place, or a delivery address you do not recognise saved to your account.

Also pay attention to a sudden burst of password reset emails from services you use. That often means somebody is working through a list with your email address on it, and while each individual message is harmless, the pattern is a warning that you are being targeted.

The two changes that end this

Almost everything written about password security is a long list. For this specific attack, two changes do nearly all the work, and the rest is optional.

Stop reusing passwords. This is the root cause, and fixing it makes credential stuffing structurally impossible against you. A breach at one company then exposes exactly one account. Nobody can do this by memory, which is why password managers exist: the manager generates a different random password for every site and remembers all of them, and you remember one strong passphrase that opens it. Every major browser has one built in for free, and dedicated apps do it better.

You do not need to fix every account this weekend. Do them in order of what hurts: email first, because whoever controls your email can reset everything else; then banking and anything holding money; then shopping accounts with saved cards; then the rest, whenever you happen to log in.

Turn on two-factor authentication where it is offered. With a second factor, a correct password is no longer enough, and the attacker’s stolen credential stops working even though it is technically valid. An app that generates codes is better than SMS, since text messages can be intercepted by someone who convinces your phone company to move your number. SMS is still enormously better than nothing, so if that is the only option offered, take it.

Setting up a password manager, start to finish

Between them, those two changes take an evening. Here is the longer of the two written out as steps, because setup is where people stall, usually at the moment the app asks them to invent a master password on the spot.

1. Pick one and stop comparing. Bitwarden has a free tier that genuinely covers one person across unlimited devices. 1Password is the most polished paid option. Proton Pass suits anybody already using Proton Mail. Apple Passwords comes built into every iPhone and Mac, Google Password Manager into Chrome and Android. If all your devices come from one company, the built-in option is fine; if you mix an iPhone with a Windows laptop, take the cross-platform app.
2. Create the master passphrase. Four or five unrelated words strung together, something along the lines of copper ladder mistletoe argue, beats a short string of symbols by a wide margin and is far easier to type on a phone. Say it out loud a few times. You will be typing it for years.
3. Write it on paper, once. Put the sheet where you keep your passport or your birth certificate. Nobody is burgling a document folder to steal a streaming login, and forgetting this passphrase is the single most likely way the whole plan goes wrong.
4. Save the recovery kit. Most managers hand you an emergency code or a recovery file at signup. Print it, store it with the paper from step three, move on.
5. Install it in three places. The phone app, the browser extension on your main computer, and one more device you would still have if the main one fell in a canal.
6. Turn on two-factor for the manager itself. The vault has just become the most valuable thing you own online, and it deserves the strongest protection the app offers.
7. Import what your browser already holds. Every manager ships an import tool for the major browsers. Once the logins have landed, delete the browser’s copies and switch off its offer to save new ones, otherwise you end up maintaining two half-complete sets that disagree with each other.
8. Then do nothing for two weeks. Let it capture logins as you go about a normal week. Changing forty passwords in one sitting is how people decide this was a mistake.
9. After two weeks, change five passwords. Email, bank, the shop where a card is saved, your phone carrier account, and your main social account. Use the generator, accept whatever nonsense it produces, let the manager remember it.
10. Set up emergency access. Several managers let you nominate somebody who can request access after a waiting period. Worth doing if anyone else would ever need to sort out your affairs.

The one real hazard in this arrangement is forgetting the master passphrase. Password managers are built so the company cannot read your vault, which also means they cannot let you back into it. Steps three and four exist entirely for that reason, and skipping them is the only part of this list that can genuinely cost you something.

Where to keep passwords, compared honestly

All of that assumes a vault is the right home for a password, which deserves an argument rather than an assertion. Plenty of people keep passwords somewhere else and come to no harm.

Where they live	A different password per site?	Available on your phone?	Survives losing the device?	Main weakness
Dedicated password manager	Yes, generated	Yes	Yes, it syncs	Forgetting the master passphrase
Browser’s built-in manager	Yes, generated	Yes, inside that ecosystem	Yes, tied to your browser account	Sits behind your computer login; data-stealing malware targets it
Paper notebook at home	Yes, if you bother	No	Yes, unless the house floods	Useless away from home, awkward for long random strings
Memory	Realistically no	Yes	Yes	Caps you at a handful, which is what produces reuse
Notes app or spreadsheet	Yes, if you bother	Yes	Yes	Usually plain readable text, synced to a cloud account with no second lock
One password everywhere	No	Yes	Yes	The subject of this article

The notes app is the one to move away from first. Anybody who reaches the account it syncs with reads the lot in a single go, with no second password in the way and no alert that it happened.

Paper comes out better than its reputation, oddly. A notebook in a kitchen drawer with a different password on every line defeats credential stuffing completely, because a list traded online has no route into your kitchen. It fails on convenience rather than on security, and for somebody with fifteen accounts who never signs in from anywhere but home, the trade is defensible.

Browser managers occupy an honest middle. Free, already installed, and vastly better than reuse, which makes them the right recommendation for anybody who will not install anything else. Their weak point is that filling often requires nothing more than being logged into the computer, so put a real password on the machine itself and switch on the browser option that asks for a fingerprint or password before it fills.

Turning on two-factor, service by service

With passwords handled, the second factor is the ten minutes that prevents the most damage per minute spent. Menus move around, so treat what follows as a description of where to look rather than a guarantee.

• Google: myaccount.google.com, then Security, then 2-Step Verification.
• Apple: Settings, your name at the top, then Sign-In and Security. Two-factor is already on for most accounts, so check that the trusted phone numbers listed there are still yours.
• Microsoft: account.microsoft.com, then Security, then Advanced security options.
• Amazon: Your Account, then Login and Security, then Two-Step Verification settings.
• Facebook and Instagram: Accounts Center, then Password and Security, then Two-Factor Authentication. One setting covers both.
• Your bank: usually enforced already, but check whether an app-based option exists as an alternative to SMS.
• Your phone carrier: look for an account PIN, a port-out PIN, or a number lock. That single setting protects every SMS code you will ever receive.

The kinds of second factor differ more than the setup screens suggest.

Second factor	How it works	Blocks credential stuffing	Blocks a convincing fake login page	Effort
SMS code	A text message with six digits	Yes	No	None
Authenticator app	Six digits from an app, rotating every thirty seconds	Yes	No	Small, one scan per account
Push approval	A notification you tap to approve	Yes	Partly	None
Security key	A small physical device on your keyring	Yes	Yes	Buy one, carry it, register a spare
Passkey	A key on your device, released by fingerprint or PIN	Yes, nothing is shared between sites	Yes	None once created

SMS sits at the bottom of that table and still stops this particular attack cold, which is why the advice remains to take it when nothing else is on offer. Its weakness is the SIM swap described earlier, and that weakness matters most on the accounts holding money.

Two things get forgotten at the end of the setup. Save the recovery codes the service gives you into your password manager, because losing a phone with no codes anywhere makes for a genuinely bad afternoon. Then find the option that signs out every other session, usually near the same settings page, and use it, since adding a second factor does nothing to evict somebody already signed in.

Why the advice you were given before did not work

Password rules have been around for decades and credential stuffing keeps succeeding, which suggests the old advice was aimed at the wrong problem.

Complexity requirements, the ones demanding a capital letter, a number, and a symbol, were designed to stop an attacker guessing your password. They work reasonably well against guessing. They do nothing here, because the attacker is not guessing: they have your actual password, and P@ssw0rd! is exactly as stolen as password. Complexity rules also push people toward predictable patterns, which is why so many passwords are a capitalised word followed by a number and an exclamation mark.

Forced rotation every ninety days was similarly aimed at a different threat and made this one worse. People asked to change a password regularly make small predictable edits, turning Summer2024! into Summer2025!, and they reuse the pattern everywhere. Most security guidance, including from national standards bodies, has now dropped routine rotation in favour of changing passwords when there is a reason to.

Security questions deserve a specific mention because they actively help attackers. Your mother’s maiden name and the street you grew up on are not secrets, they are facts, frequently discoverable and frequently identical across every site that asks. Where you cannot avoid them, the right approach is to treat them as additional passwords: type random text and store it in your password manager alongside the login.

What changed the picture is length and uniqueness. A long passphrase resists guessing far better than a short complex string, and uniqueness is what breaks the reuse chain. That is the whole modern recommendation, and it is simpler than what it replaced.

What the standards bodies say now

That shift from complexity to length now appears in the documents corporate IT departments follow, which is why password rules at work have quietly started to loosen.

The reference point is NIST Special Publication 800-63B, the American digital identity guidance that much of the English-speaking world copies without saying so. Its fourth revision reversed the advice that had shaped login forms since the early 2000s.

• Length carries the weight. Eight characters is the floor for a user-chosen password, and fifteen is the recommendation where the password is doing the job on its own.
• Composition rules are out. Systems should stop demanding a capital, a digit, and a symbol, because that requirement produces predictable substitutions rather than genuinely harder passwords.
• Scheduled expiry is gone. Passwords should change on evidence of compromise, rather than because ninety days elapsed.
• Long passwords must be accepted, along with spaces and the full range of characters, so a generated string or a spoken phrase actually fits in the box.
• New passwords should be screened against lists of ones already known to have leaked, which is the same kind of data Have I Been Pwned publishes.
• Pasting into a password field must work, an explicit accommodation for password managers.

The UK’s National Cyber Security Centre arrives at the same destination from a different direction with its three random words advice, aimed at somebody choosing a password by hand rather than generating one.

You will still meet sites enforcing the old rules, complete with a maximum length of sixteen characters, a ban on certain symbols, and a paste block that fights your password manager. Arguing with them achieves nothing. Let the generator produce the longest string their form will swallow, save it, carry on. A constrained unique password still breaks the reuse chain, which is the entire point.

The gap between published guidance and live login forms runs to years, and every one of those stubborn forms was designed to defeat an attacker sitting at a keyboard guessing. The attacker in this article already holds the answer.

Passkeys, and whether to bother

You will increasingly be offered a passkey instead of a password, often as a prompt you dismiss because you are in a hurry. The offer is worth taking when it appears on an account that matters.

A passkey replaces the password with a key stored on your phone or computer, released only after you approve with a fingerprint, a face scan, or your device PIN. There is nothing to type and nothing to remember.

The relevance to this attack is that a passkey cannot be reused across sites, because a different one is created for every account. There is no shared secret to be stolen from one company and tried at another, so credential stuffing has nothing to work with. Passkeys are also bound to the real website, which means a convincing fake login page cannot collect anything usable.

The common worry is losing the phone. Passkeys sync through your existing account with Apple, Google, or your password manager, in the same way your photos do, so a replacement device restores them. That does mean your protection rests on that account being secure, which is a good argument for making sure it has strong protection of its own.

Adopt them where offered on important accounts and stop worrying about the rest. Most sites will keep a password as a fallback for years, so this is a gradual improvement rather than a switchover.

Setting up your first passkey

The gradual improvement has travelled further than it feels from the inside. The FIDO Alliance, the industry group behind the standard, reported something on the order of five billion passkeys in use worldwide in its 2026 count, with roughly three quarters of surveyed people having enabled at least one somewhere. Around half of the hundred most visited websites now accept them.

Creating one takes about ten seconds, and the first time is the only confusing time.

1. Choose an account that matters. Google, Apple, Microsoft, Amazon, PayPal, and eBay all support passkeys. Your email account is the one worth doing first.
2. Decide where it will live. Your phone or computer can hold it in the built-in keychain, or your password manager can hold it in the vault. If your devices come from different companies, the password manager keeps life simpler; if you live entirely inside Apple or entirely inside Google, the built-in option is fine.
3. Find the setting. It sits under Security almost every time, labelled Passkeys, with a button reading Create a passkey or Add a passkey.
4. Approve the prompt. A box appears asking where to save the passkey, then asks for your fingerprint, your face, or your device PIN. That is the entire creation process.
5. Sign out and back in once. Do this deliberately, while you have time, so you know what a normal passkey prompt looks like. Recognising the normal thing is what makes the abnormal thing obvious later.
6. Keep the password and the second factor. The site will almost certainly retain both as a fallback anyway, and removing them now buys you nothing.
7. Add a second passkey. Where a service allows more than one, register your laptop as well as your phone. A spare costs a minute and saves a bad day.

Signing in on a computer belonging to somebody else works differently and is worth trying once so it never catches you out. The site displays a QR code, you point your phone’s camera at it, your phone asks for your fingerprint, and the browser signs in. The two devices confirm over Bluetooth that they are physically near each other, which is precisely why a scammer cannot email you a QR code and collect your account. No key ever leaves your phone.

One piece of housekeeping. If you sell or hand on a device, remove its passkeys from the account settings of each service, the same way you would deregister an old phone from a streaming subscription. Passkeys stored in your Apple, Google, or password manager account follow you to a replacement device on their own, so there is rarely anything to recreate.

Checking where you already stand

You can find out whether your email address appears in known breaches, and it takes about a minute. Have I Been Pwned, run by a security researcher and widely trusted in the industry, lets you enter an address and see which breaches included it. Most people find several. That is normal and not a cause for alarm by itself.

Treat the result as a work list rather than a verdict. If a site you still use appears, change that password to something unique. If your password manager offers a security audit, run it: most will flag reused and weak passwords across your saved logins, which turns an abstract worry into a specific list of things to fix.

Working through the list without losing a weekend

The audit is worth opening, so here is where it hides. Bitwarden keeps it in the web vault under Reports, split into exposed, reused, and weak passwords. 1Password calls it Watchtower. Apple’s Passwords app lists Security Recommendations. Google’s version lives at passwords.google.com under Checkup, and Chrome, Edge, and Firefox each have an equivalent buried in their password settings.

Whichever one you open, the first result deflates you. A number appears. The number is larger than you expected, and closing the tab starts to look appealing. Sort the list instead.

Four practical buckets fall out of that tree. Reused and holding money goes today. Reused and still in regular use goes this month. Reused on an account you abandoned in 2016 is a candidate for deletion rather than a new password, and closing it removes a row from every future combo list. Weak but unique can wait until the next time you happen to sign in, because uniqueness is already doing the heavy lifting.

Pace matters more than thoroughness. Five accounts a day for a week clears most people’s list, and every one you finish stays finished. Very little security work has that property; this one does, because a generated password never quietly drifts back into being reused.

A caution about the tempting shortcut. Some managers offer to change passwords automatically on supported sites. The feature works, and it works on a short list of sites, so treat it as a bonus rather than the plan.

Three checklists worth keeping

Triage handles a list you already have. These three cover the other jobs: starting from nothing, ordering the work, then keeping the whole arrangement from drifting back.

The first hour

1. Install a password manager, create the master passphrase, write it on paper. (10 minutes)
2. Change your main email password to a generated one and save it. (10 minutes)
3. Turn on two-factor for that email account with an authenticator app, and store the recovery codes in the vault. (5 minutes)
4. Check every email address you use at Have I Been Pwned. (5 minutes)
5. Change your banking password and turn on the strongest second factor offered. (10 minutes)
6. Add a port-out PIN or number lock to your phone carrier account. (5 minutes)
7. Run the manager’s audit and note the ten worst offenders. (10 minutes)
8. In each account you touched, sign out all other sessions. (5 minutes)

The order to fix accounts in

1. Every email address you control, including the old one you keep for junk, because it may still be the recovery address somewhere.
2. Your phone carrier account.
3. The password manager itself.
4. Banks, brokerages, and payment apps.
5. Anything with a card saved: shops, food delivery, taxis, streaming.
6. Tax, health, insurance, and government portals.
7. Social media and messaging, which are identity as much as entertainment.
8. Cloud storage and photo backups.
9. Loyalty schemes carrying a balance.
10. Everything else, whenever you next sign in.

The annual twenty minutes

• Rerun the password manager’s audit and recheck Have I Been Pwned.
• Look at the devices and active sessions listed on your five most important accounts, and remove anything you no longer own.
• Confirm the recovery email address and phone number on your email accounts are still yours.
• Delete saved cards you no longer use, especially on shopping and food accounts.
• Check that the paper copy of your master passphrase still matches reality.
• Close accounts you have stopped using.
• Confirm your emergency access contact is still the right person.

Put the annual one in a calendar on a date you will not resent, and treat the whole thing as maintenance rather than a project.

Questions people actually ask

The objections below come up every time this subject is raised, and most of them are reasonable.

Is a password manager safe if the company gets breached?

Safer than the alternative, which is the comparison that counts. Your vault is encrypted with a key derived from your master passphrase, and a properly built manager never receives that passphrase, so a stolen vault file reaches the attacker as a locked box. Opening it means guessing your master passphrase offline, which is exactly why length is worth caring about there and nowhere else.

The LastPass incident in 2022 is the case people remember, when copies of customer vaults were taken. Users with short or reused master passwords faced a real problem. Users with a long unique passphrase held a box nobody could get into. Keep the app updated, choose a long passphrase, put two-factor on the manager account. The maths then stays on your side.

What if I forget the master password?

Recovery, where it exists, comes from the emergency kit issued at signup, from a device where you are still signed in, or from a nominated emergency contact after a waiting period. Failing all of those, most managers offer only a reset that wipes the vault, because the design keeping the company out of your data also keeps them from helping you.

If you are still signed in anywhere, export your passwords immediately, before touching anything else. Then set up again properly, and write the new passphrase down this time.

Are browser-saved passwords good enough?

Good enough is a fair description. A browser that generates a different password for every site has already solved the problem this article describes, and the gaps that remain are smaller than the one it closed.

Those gaps: browser vaults typically sit behind your computer login rather than a separate password, information-stealing malware targets them specifically, and moving between ecosystems is awkward. Put a real password on your computer account and switch on the browser setting that asks for a fingerprint before it fills anything. That covers most of it.

Should I write passwords down?

Yes, if the honest alternative is reuse. A notebook at home is exposed to burglars and house fires, neither of which scales to millions of victims from a laptop in another country. Keep it at home, keep it out of your bag, and please do not label the cover.

Write down the master passphrase in particular. That one belongs on paper regardless of what else you decide.

What about my elderly parent’s accounts?

Do fewer things and finish them. Two accounts, their email and their bank, each with a second factor, cover the great majority of the risk. Everything else can wait indefinitely.

Use whatever already exists on the device rather than introducing a new app: Apple Passwords on an iPhone, Google Password Manager on Android. Passkeys are a genuine win here, since a fingerprint is easier than typing a long string. Set up emergency access with yourself as the contact, or put their master passphrase in a sealed envelope alongside their other documents. Then warn them about the follow-up call, because somebody who can recite their address and their last order sounds exactly like the bank.

Resist becoming their password manager yourself. Accounts should stay in their name, with you as the backup rather than the front door.

Should I pay for one?

Start free. Bitwarden and Proton Pass both have free tiers that cover a single person properly, and the built-in managers cost nothing at all. Paying buys family sharing, emergency access, hardware key support, and better recovery options, all of which are worth having and none of which are the reason any of this works.

What to do if an account was taken

Move in this order, because doing it out of order wastes effort.

Get back into the account and change the password to a new, unique one. Then check for changes the attacker made to keep their access: a new delivery address, a changed recovery email or phone number, a new payment method, or forwarding rules if it is an email account. Attackers routinely add a recovery address so they can take the account back after you reset it, and resetting the password without removing that address just starts the cycle again.

Remove saved payment methods and check recent orders. Contact your bank if anything was charged, since card fraud protections are strong and time-sensitive.

Then change the password on every other account where you used that same password, which is the step people skip and the one that matters most. The attacker has a list, and they are working through it.

Companies will keep losing databases, and old credentials will keep circulating. The one variable you control is whether a password stolen from a company you forgot about in 2019 still opens anything today.