Password reuse and 2FA gaps still drive account takeover risk

At a glance

What this is: This article argues that password security still fails first at reuse, weak construction, and weak second factors, making account takeover an ongoing identity governance problem.

Why it matters: For IAM teams, the issue spans human identity and adjacent NHI controls because credential hygiene, recovery, and sharing practices determine how easily attackers can pivot into protected systems.

By the numbers:

• According to the 2025 Verizon Data Breach Investigations Report, 60% of breaches involved a human element.
• 92% of Bitwarden survey respondents admitted to reusing passwords across multiple sites.
• A 16-character password of similar composition would take approximately 1 billion years to crack.

👉 Read Bitwarden's guidance on securing passwords and stopping credential reuse

Context

Password security is still an identity control problem, not just a user hygiene problem. When passwords are reused, exposed, or shared through weak channels, attackers only need one compromised secret to turn a single failure into broad account access.

For IAM and security teams, the article reinforces a familiar but stubborn truth. Human identity programmes, NHI governance, and privileged access controls all depend on strong credential practices, because weak authentication remains the easiest way to turn access into compromise.

Key questions

Q: How should security teams stop reused passwords from leading to account takeover?

A: Security teams should block known-compromised passwords, require unique credentials, and use password managers so users do not fall back to reuse. Credential stuffing succeeds because one leaked secret can open many accounts. The control objective is to make every password non-portable across systems and reject exposed secrets before they are activated again.

Q: Why do weak fallback channels still undermine two-factor authentication?

A: Weak fallback channels matter because an attacker often targets the easiest route back into the account, not the strongest one. SMS, email, and lax recovery questions can be intercepted, guessed, or socially engineered. If recovery is weaker than primary authentication, the second factor only delays account takeover instead of preventing it.

Q: What do organisations get wrong about password managers?

A: Organisations often treat password managers as convenience tools rather than governance controls. In practice, they shape how secrets are created, stored, shared, and recovered. If the master credential is weak or sharing is unmanaged, the vault can become a concentration point instead of a risk reducer.

Q: Who is accountable when credential reuse leads to a breach?

A: Accountability sits across identity governance, security operations, and the business owner of the affected system. If the organisation allows reuse, accepts weak recovery paths, or fails to screen exposed passwords, the control failure is structural. Frameworks that govern authentication and access hygiene should be mapped to those responsibilities.

Technical breakdown

Why password reuse turns one breach into many accounts

Password reuse creates a multiplier effect because the same secret can unlock unrelated systems after one exposure. Credential stuffing uses bots to test leaked usernames and passwords at scale, often within seconds, against many services until a match appears. The problem is not just password strength. It is the fact that a valid credential remains valid wherever it was reused, regardless of the original breach context. This is why password hygiene is inseparable from identity risk management, not just end-user discipline.

Practical implication: eliminate reuse through password managers and block known-compromised credentials at sign-in and reset points.

How 2FA changes the attack path for human identity

Two-factor authentication adds an additional verification step beyond a password, which means a stolen secret is no longer sufficient on its own. Time-based one-time passwords, authenticator apps, and security keys all reduce the usefulness of leaked credentials, though some methods are stronger than others. SMS and email are easier to intercept or abuse than separate authentication apps or hardware-backed methods. The security value comes from forcing the attacker to satisfy a second control that is not tied to the same secret they already stole.

Practical implication: prefer phishing-resistant or app-based second factors for high-risk accounts and remove weaker fallback methods where possible.

Password managers as identity control, not just convenience

A password manager changes behaviour by making unique, long passwords practical at scale. It encrypts a vault with one master credential, generates new secrets, and supports secure sharing and recovery workflows that would otherwise push users back toward reuse or insecure transmission. In governance terms, the manager becomes part of the identity control plane because it shapes secret creation, storage, sharing, and rotation. That matters for both human accounts and any operational workflow where secrets still exist.

Practical implication: standardise on password managers for users and teams, then govern master credential protection and sharing practices tightly.

Threat narrative

Attacker objective: The attacker wants valid access that looks legitimate enough to bypass basic authentication controls and reach multiple accounts quickly.

1. Entry occurs when attackers obtain exposed or reused credentials from breach dumps, phishing, or weak sharing practices.
2. Escalation follows when credential stuffing or password reuse lets the same secret open additional accounts and services.
3. Impact is account takeover, which can expose confidential data, financial records, and other protected systems at scale.

Breaches seen in the wild

• Shai Hulud npm malware campaign — Shai Hulud campaign: npm malware exposed secrets on GitHub.
• Reviewdog GitHub Action supply chain attack — reviewdog/action-setup GitHub Action supply chain attack exposed secrets.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Password reuse is a governance failure because one compromised secret can outlive the original breach. The article correctly treats reuse as the central failure mode, not a minor user habit. Once the same password is valid across multiple systems, attackers do not need sophistication, only volume and automation. The practitioner conclusion is simple: identity programmes must treat password uniqueness as a control boundary, not a preference.

Two-factor authentication reduces exposure, but weak fallback channels still preserve the attack path. SMS and email codes are better than no second factor, yet they remain easier to intercept than stronger app-based or hardware-backed methods. That means MFA policy cannot stop at enablement. The control only holds when the second factor is materially harder to steal than the password it protects. The practitioner conclusion is to govern factor strength, not just factor presence.

Secret sharing deserves the same scrutiny as secret creation. Encrypted sharing tools reduce exposure, but unencrypted email, text, and written notes extend the trust boundary far beyond the intended recipient. In practice, many password incidents begin after the secret is already created but before it is safely stored or transferred. The practitioner conclusion is to govern password lifecycle end to end, including generation, storage, sharing, and recovery.

Long passwords change the economics of attack, but they do not solve account lifecycle weakness. A 16-character secret can be vastly harder to brute force, yet an exposed or reused password remains usable until it is detected and replaced. That is why password length, rotation triggers, and compromise detection must operate together. The practitioner conclusion is to combine long unique credentials with compromise detection and disciplined reset workflows.

Identity teams still overestimate human resilience and underestimate the scale of credential abuse. When 60% of breaches involve a human element and reused credentials remain widespread, the security problem is systemic rather than accidental. The broader lesson is that authentication controls, user behaviour, and recovery design must be governed as one programme. The practitioner conclusion is to align human IAM, PAM, and credential hygiene around the same risk model.

From our research:

• 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
• Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities.
• For a broader governance lens, see Top 10 NHI Issues for the control gaps that make credential abuse harder to detect and contain.

What this signals

Secret hygiene is still the baseline control that makes everything else work. Even strong MFA and modern access tooling cannot compensate for broad password reuse or uncontrolled sharing. For identity programmes, the next maturity step is not another layer of login friction, but tighter control over how secrets are created, stored, and retired.

Compromise detection must sit closer to the credential lifecycle. If breached-password screening is only used during incident response, organisations are already behind the attacker. The better pattern is to treat exposed-secret checks as a preventive control at enrollment and reset, then align it with NIST Cybersecurity Framework 2.0 protection outcomes.

Password managers are now a governance dependency, not an optional productivity tool. When users need unique credentials across many systems, the programme has to make secure secret storage usable. That is especially true where human identity and NHI workflows overlap, because weak secret handling in one area often becomes the shortcut attackers use in the other.

For practitioners

• Block known-compromised passwords at creation and reset time Use breached-password screening in registration, reset, and change flows so exposed secrets are rejected before they become active again.
• Standardise unique passwords through a managed password manager Make password manager usage the default for users and teams so long, random, unique passwords are practical at scale.
• Prefer stronger second factors for privileged accounts Use authenticator apps or hardware-backed methods for sensitive access, and reduce reliance on SMS or email where risk is higher.
• Remove insecure password-sharing paths from daily work Replace email, text, and informal sharing with encrypted transfer methods and verify recipient details before sending credentials.
• Tune recovery workflows to prevent bypass through weak fallback methods Review security questions, recovery channels, and reset approvals so an attacker cannot regain access after a password or second factor is lost.

Key takeaways

• Password reuse remains the fastest route from one exposed secret to multiple account compromises.
• Evidence from both breach research and survey data shows that human behaviour and weak recovery design still drive a large share of identity risk.
• The most effective response is governance over the full credential lifecycle, not just stronger passwords at creation time.

Key terms

• Credential stuffing: An attack method that uses leaked username and password combinations against many services in automated batches. It works because people reuse passwords, allowing one breach to become many successful logins. The attacker is not cracking passwords in real time, only replaying valid ones at scale.
• Two-factor authentication: An authentication method that requires a second proof in addition to a password. Common forms include authenticator app codes, SMS codes, email codes, and hardware security keys. The security value depends on the strength of the second factor and how easily it can be intercepted or bypassed.
• Password manager: A tool that stores credentials in encrypted form and helps generate, save, and share unique passwords safely. In mature identity programmes, it is part of governance because it shapes how secrets are created, used, and recovered. It reduces reuse by making strong credentials practical at scale.
• Recovery channel: The process or path used to regain access after a password or second factor is lost. Recovery questions, backup codes, email resets, and support workflows all count. If the recovery path is weaker than the primary login, attackers will target it as the fastest way around stronger controls.

What's in the full article

Bitwarden's full article covers the practical password guidance this post intentionally leaves at the strategy level:

• Step-by-step guidance for checking whether credentials have been compromised using public breach data and password reports
• Specific password construction advice, including length, passphrases, and why additional characters materially change attack cost
• Operational guidance on two-factor authentication choices, including when authenticator apps outperform SMS or email
• Password manager capabilities for secure storage, sharing, and recovery that the strategic summary does not enumerate here

👉 Bitwarden's full article covers password checks, 2FA choices, and password manager features in more operational detail

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.