# Your Password Was Leaked — Here's What to Do > A calm, practical guide to a leaked password: how passwords actually leak (breaches, credential stuffing, infostealers and reused passwords), how to check whether yours is exposed, the immediate steps to take, and why unique passwords, a password manager, MFA and passkeys are the durable fix — plus what organisations should do to monitor breached credentials. Source: https://playciso.com/blog/leaked-password-what-to-do · Published: 2026-10-23 · Publisher: PlayCISO (https://playciso.com) --- If you have just learned that one of your passwords was leaked, here is the reassuring part first: this is common, and it is fixable. Act promptly, but you do not need to panic — a leaked password is only genuinely dangerous when it is reused or unprotected by a second factor, and both of those you can fix today. ## How passwords actually leak Understanding the mechanism helps you respond proportionately. There are three main routes: - A service breach. A site or app you used was breached, and the credentials it stored were exposed. If those passwords were stored as weak or unsalted hashes, attackers crack them quickly; the resulting lists circulate and get combined into huge aggregate dumps. - Credential stuffing. Attackers take username-and-password pairs leaked from one place and automatically try them against many other sites. This works for one reason only: password reuse. If your email-and-password combination from a breached forum is also your combination at your bank, the attacker is now in your bank. - Infostealer malware. Malware on a device harvests saved passwords, browser-stored credentials and even active session cookies directly from the machine, bypassing the login entirely. The thread running through all three: a single leak rarely stays a single-account problem on its own. It spreads because the same password was used in more than one place. ## What to do right now If you know a specific password is exposed, work through these in order: - Change the affected account's password first. Set a new, long, random, unique password — not a small tweak of the old one. - Change it everywhere you reused it. This is the most important step. Every account that shared that password is exposed until you change it. If you cannot remember where you reused it, assume broadly and prioritise email, banking and anything holding payment details or personal data. - Turn on multi-factor authentication. Enable MFA on the account if it is not already on, and prefer a phishing-resistant method — a passkey or a FIDO2 security key — over SMS codes, which can be intercepted or SIM-swapped. - Check for unauthorised access. Review recent logins, recovery email and phone settings, forwarding rules, and any messages or transactions you did not make. Attackers often change recovery settings first to keep a foothold. - Watch for follow-on phishing. A leak is frequently followed by convincing lures that reference it ("your account was breached, click here"). Treat unsolicited links with suspicion and navigate to sites yourself. ## How to check whether you are exposed You do not have to guess. Reputable breach-notification services — the well-known "have I been pwned"-style sites — let you enter an email address and see which known breaches it has appeared in. Some let you check whether a specific password has shown up in any dump, using a privacy-preserving method so the full password never leaves your device. A good **password manager** builds this monitoring in: it continuously flags passwords that are reused, weak, or known to appear in breach datasets, and prompts you to fix them. Modern browsers increasingly do the same for saved credentials. Treat any hit as a cue to change that password everywhere and switch on MFA. ## The durable fix is structural Scrambling to change passwords after each leak is exhausting and never quite complete. The lasting fix is to change the structure so that a leak simply cannot cascade: - A password manager, for unique passwords everywhere. When every account has its own long, random password, a breach of one service exposes exactly one account — credential stuffing has nothing to reuse. This single change neutralises the most common way one leak becomes many. - MFA everywhere it is offered. With a second factor, a stolen password on its own is not enough to log in. Phishing-resistant factors (passkeys, FIDO2 keys) are strongest; any MFA beats none. - Passkeys where supported. Passkeys replace the shared-secret password with a cryptographic key pair — there is no password stored on the server to leak, and the credential is bound to the real site's origin, so it cannot be phished. Adopting them removes the leakable secret entirely. With unique passwords plus MFA in place, a future "your password was leaked" notice becomes a minor, contained event rather than an emergency. ## What organisations should do The same logic scales up. For a business protecting employee and customer accounts, the equivalents are: - Breached-credential monitoring. Continuously check whether corporate or customer credentials appear in known dumps, and force a reset when they do — attackers reuse old dumps for years, so this is ongoing, not a one-off. - Enforced MFA, ideally phishing-resistant, so leaked passwords cannot be used alone. - Credential-stuffing defences. Rate-limiting, bot detection, and alerting on spikes of failed logins spread across many accounts — the signature of a stuffing campaign. - Block compromised passwords at the point of entry. Reject known-leaked and common passwords when a user sets one, so a bad password never gets established in the first place. Underpinning all of it, treat exposed credentials as an ongoing [identity risk](/tools/identity-risk) to be managed, not a cleanup task that ends. The accounts an attacker most wants are the ones that reach other systems, which is also where monitoring and strong factors pay off most. ## The takeaway A leaked password matters for two reasons only: it may have been reused, and it may not be backed by a second factor. Close both gaps — unique passwords through a manager, MFA and passkeys everywhere you can — and a single leak stops being a crisis. Do it once, structurally, and you stop fighting the same fire after every breach. ## Frequently asked questions **My password was leaked — what first?** Change it on the affected account, then everywhere you reused it, make each new one unique, turn on MFA, and check the account for unauthorised access and recovery-setting changes. **How do passwords get leaked?** Service breaches expose stored credentials; credential stuffing replays reused passwords across sites; and infostealer malware harvests saved passwords from devices. Reuse is what spreads the damage. **How do I check if mine is leaked?** Use a reputable breach-notification service to check your email or a specific password, or let a password manager continuously flag reused, weak and breached passwords. **How do I stop a leaked password from mattering?** Remove reuse (a password manager gives every account a unique password) and add a second factor (MFA, ideally passkeys or FIDO2 keys) so a stolen password alone is useless. **What should organisations do?** Monitor for breached credentials and force resets, enforce phishing-resistant MFA, defend against credential stuffing with rate-limiting and detection, and block known-compromised passwords when they are set.