Somewhere out there, on a list criminals are trading right now, is at least one password you've used. That's not a scare tactic, it's just arithmetic. Billions of passwords have leaked from hacked websites over the years, and if you've been online more than a decade, yours are in the pile. Sorry.
That part's survivable. What turns it into a disaster is one habit: using that same password in more than one place.
How one leaked password becomes a break-in
Here's the play, step by step:
- Some website you signed up for years ago gets hacked. A forum, a shopping site, an app you forgot you ever downloaded. Your email and password leak.
- Criminals feed those leaked email-and-password pairs into automated tools that try them on everything: banking sites, email, QuickBooks, Amazon, Shopify, payroll. Millions of attempts, no human in the chair.
- Everywhere you reused that password, they're in.
This is called credential stuffing, and it's one of the most common ways businesses get compromised. Nobody "hacked" you in any dramatic sense. A computer tried a key it already had in every lock on the street, and some of your locks matched.
"But my password is really strong"
Doesn't matter. Here's the part people hate: if you reuse it, a strong password protects you exactly as well as a terrible one. The attacker isn't guessing. They already have the password from the breached site. Tr0ub4dor&3!x reused everywhere is weaker than "pizza" used exactly once.
The rule that matters was never "make passwords complicated." It's one lock, one key. Every account gets its own password.
"I can't remember 50 different passwords"
Correct. Nobody can, and you shouldn't try. That's the entire reason password managers exist.
A password manager is an app that generates a long random password for every account and remembers all of them for you. You memorize exactly one master password, the one that opens the manager, and it fills in everything else automatically, on your computer and your phone.
If that sounds like putting all your eggs in one basket, sort of, yeah. But it's a hardened basket built by security professionals, locked with MFA, and it replaces your current system, which is one egg photocopied into thirty unlocked baskets. Every security pro you will ever meet uses one. That should tell you something.
Good options: Bitwarden (excellent, and genuinely free for individuals; team plans run about $4 a head) and 1Password (more polished, from $3.99 a month for one person, no free tier). Either is a solid choice. A full comparison lands in next week's post.
What to do this week
You don't have to fix every account today. Do it in this order:
- Install a password manager (15 minutes). Pick Bitwarden or 1Password, install the app and the browser extension, and set a master password you've never used anywhere else. Make it long. Four random words like copper-mango-drift-piano beats any short jumble of symbols. Write it on paper and keep it somewhere genuinely safe. (Locked drawer at home, fine. Sticky note on the monitor, absolutely not.)
- Fix the big four (20 minutes): email, bank, payroll or accounting, and your main business system, the point of sale or Shopify or whatever runs your day. Give each a new generated password, and switch on multi-factor authentication while you're already in the settings.
- Fix the rest as you go. Every time you log into a site over the next few weeks, let the manager swap the password. Within a month you're clean, with basically zero dedicated effort.
- Bring in your team. Business plans on both tools let you share logins, the office wifi, the vendor portal, securely, instead of texting passwords around or keeping the one spreadsheet named passwords.xlsx. Yes, that spreadsheet. We've all met it. No, it can't stay.
The bottom line
You can't stop websites from getting breached. But one lock, one key, enforced by a password manager you set up in 15 minutes, means the next breach costs you one account instead of all of them.
Next week: the best free password manager for small business, an honest comparison, no affiliate spin.
In the meantime, grab the free Small Business Security Quick-Check, five checks, five minutes.