Compromised Passwords Account for 41% of Successful Logins Across Websites

A recent analysis by Cloudflare has revealed a concerning trend in online security: nearly 41% of successful logins across websites protected by Cloudflare involve compromised passwords.

This issue stems from the widespread practice of password reuse, where users employ the same password across multiple services.

Despite growing awareness about online security risks, many individuals continue to reuse passwords, often even after major breaches have exposed their credentials.

The Impact of Password Reuse

The data, collected from September to November 2024, highlights the significant risk posed by password reuse.

When including bot-driven traffic, the problem becomes even more pronounced, with 52% of all detected authentication requests containing leaked passwords.

This represents hundreds of millions of daily attempts, primarily driven by bots engaged in credential-stuffing attacks.

These attacks involve systematically testing thousands of login combinations to exploit stolen credentials and take over accounts at scale.

Popular Content Management Systems (CMS) like WordPress, Joomla, and Drupal are frequent targets due to their widespread adoption and vulnerabilities.

Cloudflare’s analysis focuses on traffic from its free plan, which includes a built-in feature for detecting leaked credentials.

This feature checks passwords against a database of known breaches without accessing or storing plaintext passwords, ensuring privacy while helping site owners identify compromised credentials.

The findings underscore the need for robust security measures, such as multi-factor authentication (MFA) and unique, strong passwords for each account.

For website owners, enabling features like rate limiting and bot management can significantly reduce the impact of automated attacks.

Mitigating the Risks

To combat these threats, both individuals and organizations must adopt stronger security practices. Users should change reused or weak passwords and enable MFA on all supported accounts.

Additionally, exploring passkeys as a more secure alternative to traditional passwords can enhance security.

For website owners, activating leaked credentials detection and issuing password resets when necessary are crucial steps.

Implementing rate limiting and bot management tools can also help mitigate the effects of credential-stuffing attacks.

By taking these measures, users and organizations can better protect themselves against the pervasive threat of compromised passwords and automated attacks.

Also Read:

Cloudflare Unveils Cloudforce One Threat Platform for IoC, IP, Hash, and Domain Analysis

See more