One hacked site.
All your accounts compromised.
Three steps simulated: database extraction, automated credential stuffing across multiple services, and a Have I Been Pwned check to see whether your address is already exposed.
A database published on the dark web
An e-commerce site is hacked. The database with emails and passwords goes up for sale.
Billions of credentials already circulate
In 2019, Collection #1 contained 773 million email addresses and 21 million cleartext passwords. Similar compilations are published every week. These databases get cross-referenced with other breaches to enrich victim profiles.
Key figures
0 %
Of internet users reuse
the same password across multiple sites
~0 B
Credentials in circulation
on the dark web in 2023 (SpyCloud)
< 0 h
Before the first attacks
after a data breach is published
A07
OWASP Top 10 · 2021
Identification & Authentication Failures
Technical demo
Follow the full cycle
From a database dump to your accounts being compromised: watch how a single reused password turns a breach on an e-commerce site into access to your work mailbox and VPN.
Interactive demonstration
Lifecycle of a reused password
Data breach flow
Database
847,213 accounts
Attacker
Waiting
Credentials
Encrypted
Dark Web
Waiting
Database breach
An attacker exploits a vulnerability (SQL injection, exposed config) to export the users table. Unsalted MD5 hashes crack in minutes with a GPU.
Credential stuffing
Stolen credentials are automatically tested (OpenBullet, Sentry MBA) against hundreds of services. Wherever the password is reused, the account is compromised.
Have I Been Pwned
Troy Hunt's free service, aggregating 13.7 billion accounts from 800+ breaches. Lets you check whether an email address or password has been exposed.
Real-world example
Collection #1 — January 2019
773 million emails. In cleartext.
In January 2019, researcher Troy Hunt discovered an 87 GB archive containing 773 million unique email addresses and 21 million cleartext passwords, compiled from over 2,000 distinct breaches. Nearly every active internet user appeared in it.
Why it's critical
→Even a password not reused in years can still be in these databases
→Attackers cross-reference multiple breaches to enrich profiles (email + password + name)
→The compilation keeps circulating and growing with new breaches
Collection #1 figures
Unique email addresses
773 million
Cleartext passwords
21 million
Archive size
87 GB
Breaches compiled
2,000+
Discovered by
Troy Hunt (HIBP)
Immediate best practices
✓Check your addresses on haveibeenpwned.com
✓Use a password manager
✓Enable MFA on every critical account