Why does one leaked password put my other accounts at risk?

People assume a breach at a minor website is a minor problem. It is not, and the reason is mechanical rather than dramatic. Nobody sits reading your password. It goes into a list, the list goes into software, and the software tries it everywhere, at a rate of millions of attempts.

Step by step

1. Follow what actually happens to a leaked password.A site is breached and its user table is taken. The address-and-password pairs are cracked where they were poorly protected, then published or sold. Software then replays every pair against banks, email providers, shops, streaming services and social platforms.
2. See why strength is not the protection here.The password has already been leaked in usable form. Length and symbols make cracking harder, but they do nothing once the plain password is in a list. Only being different everywhere limits the damage to the one site.
3. See why email is the account that matters.Whoever controls your email controls password resets everywhere. That is why email is the first account to make unique, the first to protect with two-factor, and the first to check after any breach.
4. Understand the near-miss variations.Reusing a password with a number on the end, or the site's name appended, is not uniqueness. Those variations are generated automatically by the same software.
5. Find out what has already leaked.Search your email addresses on a reputable breach-checking service. It lists the breaches your address appears in, which tells you which passwords to treat as public.
6. Fix it in priority order, not all at once.Email first. Then anything holding money or card details. Then anything that could be used to impersonate you. Then everything else, gradually, as you sign in to each.
7. Use a password manager so uniqueness is free.The reason people reuse passwords is that remembering unique ones is impossible. A manager removes the reason, which is why it is the single highest-value change available.
8. Add a second factor where it matters.Two-factor authentication means a leaked password alone is not enough, which breaks the automated attack entirely for that account.

Tips

• This is why you receive "unusual sign-in attempt" emails in waves — a new list has been published and is being replayed against every large service at once.
• An old account you have forgotten about is still a live route if it shares a password with a current one. Deleting dormant accounts is a real security measure, not tidying.
• Passkeys remove the problem entirely for the accounts that support them, because there is no shared secret to leak.

Common mistakes

• Assuming a breach at an unimportant site is unimportant — The site is irrelevant. What leaked is a working email-and-password pair, and the attack targets everywhere else you used it.
• Changing the password only on the breached site — It leaves the pair working everywhere else you reused it, which is where the actual loss happens.
• Rotating one password into another site's password — It spreads the same secret rather than containing it. Every site needs its own.

Questions people ask