Nobody Guessed Your Password. They Just Reused It.

A bot in a data center somewhere is trying your email address on 130 different websites right now, and it already knows the password. Not a guess. Not a dictionary of common ones. The actual string you typed — because you typed it before, somewhere that got breached, and attackers bet you were lazy enough to use it twice.

That bet pays off a staggering amount of the time. A Google and Harris Poll survey found that 65% of people reuse the same password across multiple sites, and a chunk admit to using one password nearly everywhere. You probably read that number and thought, sure, other people. That's the whole business model. The attacker isn't counting on you specifically being careless. They're counting on 65% of a stolen list being careless, and they only need a sliver to hit.

This is credential stuffing, and the name is literal. Someone takes a dump of leaked email-and-password pairs — Have I Been Pwned now indexes more than 14 billion compromised accounts across thousands of breaches — and "stuffs" those pairs into login forms across the internet. Banks. Streaming services. Loyalty programs. Your email itself. They automate it, rotate through proxy IPs so nothing looks suspicious, and let the volume do the work.

And the volume is absurd. Akamai, which sits in front of a large fraction of web traffic, has logged tens of billions of credential-stuffing attempts in a single year, with some reports measuring well over a hundred billion annually. One compromised password doesn't open one door. It's a master key being tried against every lock on the street, fast, by something that never gets tired.

Here's the part that should reframe how you think about it. The login page you reused that password on didn't have to be breached. The weak site that leaked it — a defunct forum, a 2014 retailer, a trivia app — hands attackers the key to the strong sites. Your bank can have perfect security and still lose, because the password protecting it was already sitting in a text file sold for pennies, harvested from somewhere with the security of a screen door.

So how do you know if you're in one of these dumps? Often, you already got told. Not by a security briefing — by your spam folder. Those "unusual sign-in attempt," "confirm your account," and "we noticed a login from a new device" emails you reflexively delete are frequently the real, legitimate alarm firing because a bot tried your credentials and tripped a rate limit. Real breach notifications and real login alerts get swept into spam constantly, right alongside the fake ones impersonating them. The signal is there. It's just buried under the noise that's designed to look identical.

The fix is boring and it works. Stop reusing passwords — a password manager makes every login a unique random string, so a leak from one site poisons exactly one account instead of all of them. Turn on two-factor authentication, which means a correct stolen password still fails at the second step. And actually check whether your address is in a known breach; Have I Been Pwned will tell you for free, and most password managers now flag reused and compromised entries automatically.

The uncomfortable truth is that the hardest-working attacker targeting you isn't a hacker in a hoodie. It's a script, running a list, exploiting the one habit almost everyone shares and almost everyone assumes doesn't apply to them.