The essentials
- The breached site is the smallest problem; credential-stuffing bots try that password against hundreds of other services within hours of a dump circulating.
- Change the password everywhere it was reused — not just where it leaked. Reuse is the entire attack surface.
- This is the moment to adopt a password manager: unique passwords end this class of problem permanently.
- MFA on email, banking, and work accounts blunts stuffing attacks even where reuse existed.
- Expect targeted phishing that quotes the leaked data to look credible.
Breach dumps are traded, merged, and replayed for years. When your credentials appear in one, automated tools immediately try them against banks, email providers, retailers, and employers — that replay is called credential stuffing, and it is why one small site's sloppiness endangers your important accounts.
The fix is mechanical, and worth doing properly once: map the reuse, break it, and make reuse impossible going forward.
Do this now
- Map where that password lives. List every account sharing the leaked password or a close variant of it. Variants count — attackers try "Password2024!" when "Password2023" leaks.
- Change email first. Your inbox resets everything else, so it gets the first new, unique password and the strongest MFA.
- Work down the list. Banking, work accounts, shopping with stored cards, then the rest. Unique password each, generated by a manager.
- Turn on MFA where it counts. App-based codes or passkeys on email, financial, and work accounts. SMS is better than nothing, but app or key beats it.
- Check for use you didn't do. Login history and active sessions on the important accounts — sign out everything you don't recognize.
- For a company: force the resets. If corporate credentials appear in a dump, force resets for affected users, watch for stuffing spikes on your login endpoints, and check whether the exposure came with session tokens.
What not to do
- Do not change the password only on the site that leaked.
- Do not rotate to a pattern variant of the same password — dumps train the guessing tools.
- Do not dismiss an "old" breach; dumps get replayed for a decade.
- Do not click links in emails offering to "check if you were affected" — go to known services directly.
- Do not store the new passwords in a spreadsheet named passwords.
Preserve the evidence
Whatever else happens, these are the artifacts the investigation — and any insurance claim, dispute, or prosecution — will be built from:
- The alert or notification, with which breach and what data classes it names.
- Your list of affected accounts and when each was changed.
- Any login-history anomalies you found while checking.
Keep a clear head
Password reuse is not a personal failing — humans cannot memorize ninety unique strong passwords, which is why the system that demanded it failed, not you. A manager removes the memory problem entirely.
An hour of methodical resets today closes a door that would otherwise stand open for years.
Questions victims ask
The password in the dump is one I stopped using ages ago. Ignore it?
Check for variants and stragglers first — old passwords linger on accounts you forgot you had, and pattern variants of it are guessable. If it truly appears nowhere, archive the alert and move on.
What exactly is credential stuffing?
Automation that takes leaked email-password pairs and tries them across hundreds of unrelated services. It succeeds purely on reuse, which is why unique passwords end the threat.
Are paid dark-web monitoring services worth it?
They tell you sooner, which has some value, but the response is identical either way: break reuse, use a manager, add MFA. Do those and the alerts become housekeeping instead of emergencies.