Just one digit apart
Someone else’s website leaked, and the password was one digit off.
(Illustrative scenario, not a real incident)
Xiao Lü, a designer,signed up for a template site with the company email.The password was one digit away from the company email password.
An ordinary thing to do.
At this thirty-five-person event planning firm,one day the company email popped up a notice:someone had signed in from overseas.
Only afterward did they learnthat the template sitehad been breached months earlier.And the company email had no two-step verification.
The company’s own systems weren’t hacked.Someone else’s were.But the passwords looked too much alike,and the risk walked from someone else’s house into theirs.
Taking leaked usernames and passwords and trying them everywherehas a name: credential stuffing.
Even if the password isn’t reused,a company email on a leaked listcan become the target of the next wave of phishing.
And by the time a breach is made public,it has usually been going on for a while.
Laozi said: “A tree as wide as a man’s embrace grows from a tiny shoot.”A tree too big to wrap your arms aroundstarted as the smallest bud.
An incident, too,often begins with “just one digit apart.”
- Turn on two-step verification for every company email account.
- Check public breach notifications once for your company domain.
- Remind colleagues: company passwords are never reused anywhere else.