Skip to content
RansomLeak
Blog

password security

2 posts with the tag “password security”

Password Security Training That Changes Behavior

Password security progression from a broken lock with weak passwords through a vault representing a password manager to an MFA shield with a one-time code
Dmytro Koziatynskyi
Founder & CEO

A financial services firm rolled out its annual password policy update. Minimum 12 characters, one uppercase, one number, one special character. Employees complied. Security felt good. Then a red team engagement three months later found that 38% of employees had chosen variations of “Company2026!” and that nearly half were reusing their corporate password on personal services.

The policy was technically met. The behavior it was supposed to create never materialized.

This pattern repeats across industries. Organizations invest in password rules and compliance checklists, then wonder why credential-based attacks keep succeeding. The problem is not that employees lack awareness. Most people know password reuse is risky. The problem is that knowing something is risky does not automatically produce the alternative behavior.

Credential Stuffing: How Leaked Passwords Work

Credential stuffing attack visualization showing a breached database, an automated bot, and multiple login forms being tested
Dmytro Koziatynskyi
Founder & CEO

In January 2024, a security team at a mid-size SaaS company noticed something odd. Over a single weekend, their authentication logs showed 340,000 failed login attempts across employee and customer-facing portals. The attempts came from thousands of IP addresses, rotating every few requests. Buried in the noise: 47 successful logins.

None of those 47 accounts had been brute-forced. The attackers already had the correct passwords. They had purchased a batch of stolen credentials from a 2023 breach of an unrelated service, and 47 employees had used the same email and password combination for both.

This is credential stuffing. Not a sophisticated exploit. Not a zero-day. Just a bet that people reuse passwords, and that bet pays off roughly 0.1% to 2% of the time. At scale, that is enough.