Reusing one password feels harmless — until the day it isn't. That single habit is what lets a problem at one company quietly become a problem with every account you own.
How one breach becomes many
Companies get breached regularly — even careful, well-known ones. When it happens, the leaked lists of emails and passwords get traded, sold, and merged into giant databases that circulate for years.
Then the bots go to work. Credential stuffing is software that takes your leaked email and password and automatically tries the pair on hundreds of other sites — your bank, your email, your shopping accounts. No human is sitting there targeting you. It's fast, automated, and aimed at everyone at once.
A single leaked password is harmless on its own. It only becomes dangerous when it's the same password guarding 30 other accounts. Reuse is the multiplier that turns one company's bad day into yours.
Small changes don't make a password unique
Tweaking one password into password1, Spring2024!, or your usual word
with a site name on the end doesn't help. The same tools that stuff stolen
passwords also try these obvious variations automatically. Only a genuinely
different password per site counts.
Where the chain ends
These attacks almost always head toward two things: your email and your money.
Email is the real prize. Once someone is inside your inbox, they can click "forgot password" on almost everything else and reset their way in — which is exactly why the next lesson treats your email as the master key. From there it's a short step to your bank, your stored cards, and your identity.
You control the one thing that matters
You can't stop a company from getting breached. That part is out of your hands, and it always will be.
But you have complete control over whether one breach spreads. The fix isn't heroic vigilance — it's structural:
- A unique password for every site, generated and remembered by a password manager so you never have to.
- A second factor on your most important accounts, so a leaked password alone isn't enough to get in.
Together these break the chain reaction. One leak stays one leak. The rest of this section walks you through setting both up, step by step.
Do this now
- List your five most important accounts — usually email, banking, and a couple you'd hate to lose.
- Note which of them currently share a password (be honest — a "small change" version counts as shared).
- Rank them by damage: what could someone actually do if they got into each one?
- Keep that list handy — you'll fix the top of it first in the lessons ahead.