The account you forgot about is the one that gets you hacked

When most people think about getting hacked, they think of someone going after their main accounts, like their bank, their main email, or something they actually care about. In reality that's almost never how it happens. It's usually an account you completely forgot you even had, some old one you haven't logged into in years, which just happens to have the same password as something that actually matters to you.

There is a chain of events that lead up to all of this, it's actually pretty simple. It's the same thing you have been told for years, "don't reuse the same password".

Step one: an old website you signed up to, and forgot about gets breached

Old accounts tend to be sitting on old servers with outdated security, and a lot of the time they are run by companies that might not even be around anymore. So of course they get hacked, and it happens very, very often. In late 2025, Have I Been Pwned (a site which keeps track of data breaches) added a single dataset with roughly two billion unique email addresses and 1.3 billion unique passwords, all pulled from credential stuffing lists. That is two billion email addresses, collected from years and years of breaches and passed around between whichever hacked wanted them.

There is a likely chance your old emails and passwords are sitting in a pile like that one right now. You didn't even do anything wrong, the site that was holding your details did, and you fell victim to a lack of security and the result of a hacker accessing their databases.

Step two: you used the same password somewhere else

This is where it usually turns into a problem. Surveys keep finding that around four in five people reuse the same password on more than one site, so it is pretty likely you are one of them. Think about the password you used on that old shopping website, is it actually different from all your other ones, or is it basically the same as the one for your email, your social media accounts, or even your bank?

Attackers know that most people do this, because they're targetting it on a huge scale. That's what "credential stuffing" means, they take the leaked emails and passwords from the old account and automatically try them on hundreds of other sites to see which ones work, then they sell or use your accounts. They do not need to guess your password because they already have one you have used, they're just checking where else they can use it.

Step three: the old password gets them into something that matters

So the password from a random website or app you stopped using ten years ago ends up being the reason that gets someone into an account you still use to this day. And this data doesn't really go out of date either. Attackers will always recycle and combine these old password lists, which is why security researchers keep saying that old breaches and accounts you don't use anymore are still dangerous, years after everyone has forgotten about them. To an attacker, a leak from 2014 is still useful, so they will just keep trying it.

How to lower the risk

This advice isn't fun, it's boring but important, and that's why it works.

The first thing is to use a different passwords on every site, or at least different passwords on the accounts that you care about. A password manager makes this very easy, and it's the one change that stops everything above from working, because a single leaked password would only get them into the one site it was leaked from, and waste their time on every other site they try.

You can also turn on two-factor authentication for anything important, so even if someone does have your password, it isn't enough on its own to log in.

It is worth checking what you're already exposed in too. You can put your email into Have I Been Pwned and it will show you which breaches your email has turned up in, it's free, and for most people who have used an email for years, you might realise there's a lot. Typically, if you've used an email for many many years, it would have likely been exposed to a lot more breaches than an email you created recently.

And then delete the accounts you don't even use anymore. Most people skip this one, but it is the only thing on the list that really eliminates the risk. Look up how to delete your old accounts, the game you do not play anymore, that shopping site, the app you tried out once, and delete them. If the account doesn't exist anymore, it cannot be breached and it cannot leak your password to anybody, nor can any of the data be sold, and it's one less piece of the puzzle from your digital footprint.

That last one is why we made removi. Every old account you get rid of is one less entry in the next massive data dump, and one less chance that a password you reused years ago ends up getting someone into an account you actually care about. Unfortunately, there's nothing you can do about a company's poor security, but you can make sure your details on held by them anymore.

Sources: Have I Been Pwned's Synthient credential-stuffing dataset (roughly two billion addresses, added November 2025), and reporting on password-reuse rates and what that dataset means.