Your password may be for sale on the dark web
Nearly 18 billion accounts appear in known data breaches. Yours may be among them. How to check, and how to protect your company from account takeover.
The Have I Been Pwned service now lists nearly 18 billion accounts that have appeared in data breaches. LinkedIn, Dropbox, Adobe: entire databases of stolen credentials have been circulating for years, and new ones are added every month. Your work email addresses may be among them.
And if you use the same password on several services, like 65% of the people Google surveyed in 2019, a single hacked account opens the door to the others: your mailbox, your ERP, your CRM.
Did you know?
In June 2025, researchers found an exposed compilation of 16 billion credentials, mostly harvested by "infostealer" malware or recycled from older breaches. It wasn't a new hack of Google or Apple, but it shows that stolen credentials are collected, recycled and resold at scale.
How your passwords end up for sale
Phishing. A fake email sends you to a perfect copy of your bank's website or Microsoft 365. You enter your credentials and they are captured instantly.
Mass breaches. A service you use gets hacked. Your email and password end up in a database that is resold or published. Sometimes you only find out months or years later.
Credential stuffing. Attackers automatically test millions of stolen email and password combinations on other sites. If you reuse passwords, they walk straight in. These attacks are fully automated.
Infostealers. Malware installed without your knowledge, often through an attachment or fake software, grabs passwords saved in your browser, session cookies and what you type. These "logs" are then sold in bulk. In February 2025 alone, Have I Been Pwned added 284 million accounts from such logs.
The result? Stolen credentials have become a commodity, sold in bulk to anyone who wants to exploit them.
Our free cyber diagnostic checks whether your domain or email addresses appear in known breaches. Results in a few minutes.
3 immediate actions
No big IT budget needed. These three measures protect you starting today:
1. Enable MFA everywhere. According to a Microsoft study, multi-factor authentication cuts the risk of account compromise by more than 99%. Start with email, your ERP and your cloud tools. Prefer an authenticator app over SMS: the study shows it protects better.
2. Use a password manager. Bitwarden, 1Password, Dashlane or the one in your office suite. No more identical passwords or sticky notes. Every account gets a unique, long password, with no need to remember it.
3. Train your teams. A trained employee spots phishing, reports anomalies and follows good practice every day. According to KnowBe4 (2025), the simulation click rate falls from about one employee in three before training to around 4% after a year of regular awareness training.
Our Cyber Awareness training includes hands-on exercises on password management and phishing detection. Available as a lunch & learn, half-day or conference.
Take action
Don't wait for an account to be compromised before you act.
- Check your exposure with our free cyber diagnostic, instant and with no commitment
- Train your teams with our Cyber Awareness training
- Strengthen your security: contact us for an audit of your practices
Sources
- Have I Been Pwned, pwned accounts counter (accessed 14/10/2026)
- BleepingComputer, Have I Been Pwned adds 284M accounts stolen by infostealer malware (02/2025)
- Security Affairs, Researchers discovered the largest data breach ever, exposing 16 billion login credentials (06/2025)
- Infosecurity Magazine, Google survey finds two in three users reuse passwords (02/2019)
- Microsoft Research, How effective is multifactor authentication at deterring cyberattacks? (2023)
- KnowBe4, 2025 Phishing by Industry Benchmarking Report (13/05/2025)
