Password reuse is the breach that keeps happening to you

When people picture an account being broken into, they picture an attacker sitting in front of a login page guessing. That is not what usually happens. The far more common route is credential stuffing: an attacker takes a list of email and password pairs that leaked from an unrelated service, and tries them automatically against hundreds of other sites.

This works because the same password is used in more than one place. The attacker does not need to break anything. They just need you to have been consistent.

Why it scales so well for attackers

Credential lists circulate freely and cheaply. Automation makes testing them against a login endpoint nearly free, and the success rate does not need to be high to be profitable. A fraction of a percent across millions of attempts is still a large number of working accounts.

Rate limiting and bot detection slow this down, but they do not stop it. The only reliable defence on your side is making sure that a password leaked from one service is useless everywhere else.

What actually fixes it

Three changes, in order of impact:

• Unique passwords everywhere, which in practice means a password manager because nobody memorises 200 distinct secrets.
• Two-factor authentication on email first, then banking, then everything else. Email is the recovery route for most of your other accounts, so it is the highest-value target.
• Passkeys where they are offered. A passkey cannot be phished or reused, because there is no shared secret to steal.

A realistic starting point

You do not need to migrate 200 accounts this weekend. Start with the accounts that can be used to reset the others: your primary email, your phone account, and your password manager itself. Give each a long unique password and turn on two-factor authentication. Then work outward as you naturally sign in to things.

That sequence gets you most of the benefit in an afternoon, which matters more than a perfect plan you never finish.