Stop the Hackers at the Door: The Power of Unique Passwords
- JANUARY 15TH, 2025
- 2min read
Introduction
Have you ever used the same key to unlock your house, your car, and your office? Probably not. It’s a huge security risk. The same principle applies to your online accounts. Using the same password across multiple websites and services makes you extremely vulnerable to a type of attack called “credential stuffing.”
Credential stuffing happens when hackers obtain a list of usernames and passwords (often from data breaches at other companies) and then automatically try those credentials on many different websites. If you use the same password everywhere, they only need to crack it once to gain access to all your accounts; your email, social media, online banking, and more.
Recently, there have been numerous reports of large-scale credential-stuffing attacks targeting various online platforms. To see the wide range of businesses affected in 2024, including General Motors, see this overview: The Most Recent Credential Stuffing Attacks on Companies in 2024. These attacks highlight the importance of strong, unique passwords for every single account you own.
Best Practices for Strong, Unique Passwords
- Create strong passwords: Use a combination of uppercase and lowercase letters, numbers, and symbols. Aim for a password that is at least 12 characters long. The longer and more complex, the better.
- Never reuse passwords: Use a different, unique password for every online account. This is the single most effective way to prevent credential stuffing.
- Use a password manager: Password managers are tools that securely store and generate complex, unique passwords for all your accounts. They also automatically fill in your login details, making it easier to log in without having to remember dozens of different passwords. This is the easiest and most secure option.
- Change your passwords regularly: While not as critical if you use unique passwords, it’s still good practice to update your passwords periodically, especially for sensitive accounts like banking and email.
Explore more CIL Advisories
Review Bombing Attacks and Extortion
IntroductionMalicious actors use "review-bombing", a coordinated flood of fake, one-star reviews as an initial step for extortion. This high volume…
NOVEMBER 26TH, 2025
Read More
Synthetic Phishing: AI-Enabled Insider Impersonation
IntroductionThreat actors increasingly use artificial intelligence (AI) to impersonate trusted individuals such as executives, employees, or suppliers within organisations. These…
NOVEMBER 24TH, 2025
Read More
The Silent Security Threat: Data Hoarding
IntroductionThe greatest risk to your organization may be the sheer volume of data we hold, a practice known as Data…
NOVEMBER 19TH, 2025
Read MoreNever miss a CIL Security Advisory
Stay informed with the latest security updates and insights from CIL.
