Your Password Is Probably Already Leaked. Here’s How to Stop Caring.

Right now, some iteration of your email address and a password you haven't used in years is sitting in a database that you've never heard of getting traded like cryptocurrency.

Now, I wouldn't alarm you, these types of breaches are commonplace, and the information is regularly re-cycled for years. The question is, what to do about it.

Most people visualize an attacker 'hacking' them, but the more likely outcome is that they simply log in.

How Attackers Typically Get In

Let's deconstruct this. You probably aren't being attacked by a shadowy figure in a hoodie shouting binary code at your house. The scripter's bread and butter is often surprisingly mundane.

Credential stuffing: An attacker uses a password and email that they know about you (from a previous breaches) and stuff them into other sites to see if either of the two is valid.

Phishing: An attacker sends you a message (typically an email), threatening to take action against your account if you do not click their link and enter your password immediately.

MFA fatigue: You're using two-factor authentication, and someone is using a program to spam you with approval prompts until you accidentally say yes.

SIM swapping: An attacker convinces your mobile carrier to put your phone number on a SIM card that they possess, thereby being able to receive any authentication codes sent to your phone.

As you can probably tell, none of these require particularly brilliant attackers, just a basic understanding of how most people operate online.

The Mindset Shift: Assume Breach

This is part of a broader philosophy among security professionals known as assume breach. Rather than asking "how do I prevent being hacked?" (a loaded question, since you can't be un-hackable), they ask "if this account is breached, how much damage can I limit it to?" This is how you want to approach your personal security as well, focusing on defense rather than prevention.

Here's how you can start:

7 Habits That Make You a Hard Target

1. Use a password manager

Every account has a randomly generated, unique password that is remembered only by the manager. You pick one secure password that you can easily remember and use it to protect all the others. This breaks virtually any credential stuffing attack.

2. Make your master password a long, nonsense phrase

A 16-character random string will always be more secure than a 12-character "secure" password with special characters. Something like correct-horse-battery-staple is far better than P@ssw0rd!23.

3. Where available, use passkeys rather than passwords

A passkey is a piece of cryptographic material that serve the same function as a password, but with greater security through being tied to a device. If a site offers one of these, use them.

4. Use a more advanced form of two-factor authentication

There are different levels of security that come with 2FA:

SMS: Moderately secure, but can be bypassed at the carrier level.

Authenticator app (Time-based One-Time Password): Extremely secure and moderately annoying.

Push notification: Incredibly convenient, but vulnerable to MFA fatigue.

Passkey or hardware security key: The most secure option that doesn't involve an application.

You should enable this on your email and banking applications. Your email is essentially the key to all your other accounts.

5. Be wary of urgency

Real companies will practically never give you a dead-or-alive ultimatum to update your password or suffer dire consequences. If you're receiving one of these messages, the best thing you can do is close the tab/window and go directly to the service's website or application and update your password there.

6. Never accept an MFA prompt you did not initiate

This is a surefire way to give up your account. If you get an MFA request you did not ask for, deny it immediately and then reset your password.

7. Check to see if your information has been compromised

Go to haveibeenpwned.com and enter your email address. This will tell you if it is known to have been part of a data breach, in which case you should go change the password for that account (and any other site you may have used that email on) immediately.

A 15-Minute Security Upgrade You Can Do Today

Most attackers will go after the low-hanging fruit. That is, the people who don't take even basic precautions. Most of these precautions can be done in about 15 minutes. Here's how you can beef up your security:

1. Get a password manager.

2. Update your email password to something long and secure or set up an authenticator key or passkey for your email.

3. Do the same for your bank and your preferred social media platform.

If you don't already have an authenticator app or passkey for your email, go set one up right now. Otherwise, go to haveibeenpwned.com and check if your email has been breached.

The Bottom Line

Your security will never be absolute, but it can be strong enough that an attacker will move on to an easier target. The best part is, most of these upgrades are either free or come at minimal cost and effort. After all, the easiest way to increase security is to become a harder target than the next person. Do these things and you'll definitely be in the minority of people who do.

Did you find this useful? Then give me a clap, follow, and comment below, telling me which of these steps I will take first.