What To Do When Your Password is Exposed in a Data Breach (2024)

Cybercriminals act fast. They know the clock is ticking from the moment credentials are stolen. They use sophisticated technology and bots to compare the password against thousands of common websites and apps. By changing the exposed password the moment a breach is discovered, you minimize the risk that the criminal can use the password to access any personal or work data.

Experts highly recommend using complex passwords that are unique for every account. Using the same password on multiple accounts or reusing an old password is extremely risky. Check out SpyCloud’s tips for strong passwords for more recommendations on how to create unique, complex passwords that enhance your password hygiene.

When people are prompted to change their passwords, most decide to simply change a character or two. This may seem like a good idea and make it easier to remember, but cybercriminals are expecting it. They can take just a few characters of a compromised password and quickly crack the rest of it, even if it was recently changed. However, our research shows that cracking a complex password can take decades and ample supercomputing power.

Be sure all variations of the compromised password are changed and never use that compromised password or a variation of it ever again. Cybercriminals know users often return to old passwords. They will run that password through their system repeatedly for years.

Whenever it is offered, we recommend using multi-factor authentication (MFA). While it doesn’t provide the ultimate protection, it does offer another layer of security and is typically enough of a deterrent for all but the most persistent criminals. MFA will establish another identification method on accounts that offer the capability, often sending the user a unique code via a push notification or authenticator program on their mobile device.

Even if a cybercriminal gains access to credentials, they won’t immediately be able to access the associated account unless they provide the second factor of authentication. If the only method of MFA offered by the account is secret answers to security questions, make up the answers! Don’t use real information; it’s fairly easy to piece together from public databases or platforms like social media. Store your (fake) secret answers in your password manager. Speaking of…

One of the best ways you can protect your passwords is by using a password manager. Password managers auto-generate long, complex passwords that are near impossible for criminals to hack – and they’re unique for every account. Employees should be required to use password managers, particularly on their work-related accounts (but should extend use to their personal accounts!).