Stolen passwords: how they are taken and how to protect yourself

The door is not broken. Someone handed over the key

In short: passwords are rarely guessed any more. They are stolen by programs installed on your device, pulled from data leaks, asked for on fake pages, or taken from an account where you reused them. Then they are tried automatically on dozens of sites to see where they fit. The defence has three parts: a different password for every account, kept in a password manager, two-step verification, and, where you can, a passkey instead of a password.

What stolen passwords means

Your password does not have to be weak to reach an attacker. It only has to exist somewhere it can be taken.

Taken from your device. An infostealer grabs the passwords saved in your browser, your open sessions and sometimes files.
Pulled from a data leak. A site where you have an account is breached, and the passwords (or their fingerprints) end up on forums.
Asked for straight from you. A fake page, a text or a call convinces you to type the password or a code. More in the articles on phishing, vishing and smishing.
Reused. A password leaked from a small site is then tried on your email, your bank and your social media.
Guessed. Simple passwords such as “123456” or a child’s name, tried in bulk. This is the rarest route today.

It is one of the attack vectors, the doors scammers use to reach you.

How attackers use a stolen password

Credential stuffing. The attacker takes email and password pairs from a leak and tries them automatically on thousands of sites. They guess nothing: they check where you used the same password.
Account takeover. They enter your email, request password resets for your other accounts and take them over one by one. That is why your email is the most important account.
Stolen sessions. An infostealer also takes the “key” of a session you left open. With it, an attacker can get in without the password and sometimes without the code.
Resale. The data is sold in bundles to other criminals: some commit fraud, others break into companies.
Using your account. From there they write to your contacts, ask for money or send links, as in the WhatsApp case described in the article on smishing.

What's new in 2026

Stealer logs are everywhere. In June 2026, Have I Been Pwned added a set of logs taken by infostealers: about 56 million email addresses and 124 million unique passwords, now searchable in its Pwned Passwords service.
Infostealers are the engine. Europol describes them as a key enabler of the whole spectrum of attacks in 2025. In May 2025, Microsoft and Europol took down more than 2,300 domains of the Lumma infostealer, which had infected more than 394,000 Windows computers in two months.
Passkeys have moved from pilot to habit. According to the FIDO Alliance (Passkey Index, 15 October 2026), 36% of successful sign-ins now use a passkey, up from about 26% in 2025. Passkey sign-ins succeed 93% of the time, against 78% for traditional two-step verification, and save 27 seconds on average.
The password rules have changed. NIST SP 800-63B revision 4, finalized in July 2025, requires at least 15 characters for a password used on its own, says systems should allow passwords of at least 64 characters, forbids rules such as “one capital and one symbol”, and forbids changing passwords on a schedule unless there is evidence of compromise. It also requires checking a new password against lists of known weak or leaked ones, and requires allowing password managers.

The practical conclusion: how odd your password looks no longer matters. What matters is that it is unique, long, and cannot be taken from your device or from a breached site.

Why it works

Reuse. One password for many accounts turns a small leak into a big problem.
The password saved in the browser. Convenient, but it is exactly what infostealers look for.
Long sessions. An account left signed in for months is a key sitting in your pocket.
The code given in good faith. A verification code handed to a “courier”, a “bank” or a “friend”.
No visible signs. You do not see the password being stolen. You find out when the account does things you did not do.

How to tell your password was stolen

You get password reset emails or notifications you did not request.
Sign-ins appear from places or devices you do not know.
Friends tell you they get odd messages from you.
The account sent messages or posted without you.
Your password no longer works, and the recovery email has been changed.
A service or a bank warns you about unusual activity.
Your email address appears in a data breach, which you can check at haveibeenpwned.com.

How to protect yourself

A different password for every account. The one rule that really counts.
A password manager. It creates and remembers long, unique passwords. Use the longest ones for your email, your bank and the manager itself.
Long, not complicated. A long phrase beats a short password full of symbols. The 2025 NIST guidance moves the focus to length.
Two-step verification. Preferably with an app or a passkey, not by text message. A code sent by text can be asked for by a scammer.
Passkeys, where you can. A passkey cannot be typed into a fake page and cannot be reused. It is the best defence against phishing for important accounts.
Never share codes. Not with a “courier”, not with a “bank”, not with a “friend” on WhatsApp.
Do not keep passwords in a browser on an unsafe device. If you ever had a suspicious program, treat saved passwords as stolen.
Check regularly whether your data has leaked. At haveibeenpwned.com or with the check built into your password manager.
End old sessions. In the account settings, under “connected devices”.
A separate email for important accounts. Your bank and main email are not used to sign up on small sites.

What to do if yours were stolen

Change your email password first, from a clean device, then your bank and social media.
End all active sessions on every account. An infostealer steals sessions, not only the password.
Turn on two-step verification, preferably with an app or a passkey.
Scan the device if you suspect a malicious program, before changing passwords. Otherwise the program steals the new ones too. More in the article on malware.
Change the password everywhere you reused it.
Call your bank if you used the same password or shared card details.
Warn your contacts another way if an account of yours sent messages asking for money.
Report it to the police or your national cybercrime authority.

Do not be embarrassed. Millions of passwords are stolen every year, and it can happen to anyone.

Frequently asked questions

What is credential stuffing?

It is the automatic trying of leaked email and password pairs on thousands of sites. The attacker guesses nothing: they check where you used the same password. That is why a unique password for each account stops the attack.

How do I know whether my password was leaked?

Search your email address at haveibeenpwned.com. Many password managers run an automatic check too. If you appear in a leak, change the password on that account and everywhere else you used it.

What is a passkey?

A passkey replaces the password with a cryptographic key tied to your device and unlocked with your fingerprint, face or phone code. It cannot be typed into a fake page and cannot be reused on another site, which is why it resists phishing.

Is a password manager not a single point of failure?

It is a smaller risk than reusing passwords. Choose a well-known manager, protect it with a long password and two-step verification, and do not use it on a device you do not trust. If you have a suspicious program on the device, fix that first.

Do I need to change my passwords every few months?

No. The 2025 NIST guidance says passwords should not be changed on a schedule for no reason, only when there is evidence of compromise. A unique, long password matters more than frequent changes.

Sources and further reading

Have I Been Pwned, “June 2026 Stealer Logs”, added 15 June 2026
FIDO Alliance, Passkey Index, 15 October 2026
NIST, SP 800-63B-4 “Digital Identity Guidelines: Authentication and Authenticator Management”, final version of 31 July 2025
Europol, IOCTA 2026, published 28 April 2026
Microsoft, action against Lumma Stealer, 21 May 2025
Where to report: your bank first, then your national cybercrime authority or the police

About the author

Brîndușa Maria, Senior Software Test Analyst, ISTQB® Certified Tester Advanced Level Test Analyst (CTAL-TA). I write about how to recognize online scams. LinkedIn

Note: this article is based on my research and professional experience. I used artificial intelligence tools for drafting and editing.

📢 Share the knowledge, stay safe! 🔒✨ Use the share buttons below and help others stay safe online. The more we know about online scams, the better protected we are! 🚀💙

Stolen passwords: how they reach attackers and how to protect your accounts in 2026