Billions of Leaked Passwords Show Why Password Security Is Still Broken

Yesterday, I found a recently released report on leaked passwords, and the report makes one thing very clear. Passwords are still failing, and user behavior has barely changed even after so many data breaches and reports suggesting users to use strong passwords.

Specops Software has analyzed six billion leaked credentials from 2025, based on threat intelligence collected by its parent company, Outpost24. The findings show that weak and predictable passwords continue to dominate real-world breaches.

The most commonly compromised passwords last year were “123456”, “123456789”, “12345678”, “admin”, and “password”. These are not new discoveries. The same passwords have appeared in breach reports for years. What is worrying is that they are still being used at massive scale. For the past few years, we have been thinking it’s just a user education problem. But now I believe it is a structural security problem and needs to be addressed soon.

Also read: One Small Security Mistake Can Cost You Money, Data, and Peace of Mind

The report shows that simple numeric passwords are mostly tied to personal accounts. But credentials like “admin” and “password” are often linked to enterprise systems. These include networking equipment, IoT devices, internal tools, and even industrial control systems. When default or weak credentials are left unchanged, attackers get an easy entry point into critical environments.

Specops warns that malware-stolen passwords are often reused across systems. Once attackers have access to one set of credentials, they test them against VPNs, Active Directory, and cloud identity systems. This turns a small breach into full network access. This is the reason I always recommend not reusing passwords. But most people reuse passwords even after knowing their downsides.

Also read: Hidden Cost of Using the Same Password Everywhere

The report also shows that many leaked passwords look more complex on the surface but are still predictable. Variations of “admin”, “guest”, “welcome”, “qwerty”, “secret”, and “password” appear frequently. These patterns suggest operational and infrastructure use rather than personal logins.

Regional and cultural patterns are also visible. Passwords like “Pakistan123”, “hola1234”, “Kumar@123”, and “Rohit@123” appear in large numbers. These choices feel personal and memorable, but they are extremely easy for attackers to guess and automate.

Also Read: How Often Should You Change Your Password?

Most of these credentials were stolen using infostealer malware. Lumma was the most active strain, followed by RedLine. These tools do not rely on advanced hacking. They quietly collect saved passwords from infected systems and feed a growing underground economy of stolen access.

It is important to understand that Password theft is no longer about breaking into accounts. It is about harvesting credentials at scale and reselling them repeatedly. Once a password is leaked, it does not disappear. It circulates for years.

Even organizations that have adopted passwordless or phishing-resistant authentication are not immune. Passwords still exist in legacy systems, service accounts, internal tools, and recovery workflows. These weak links are often ignored until they are exploited.

The core issue is behavior. Users still choose convenience over security. Organizations still treat password policies as a compliance checkbox. Eight characters, one symbol, problem solved. Attackers have already moved far beyond that model.

This is why password managers matter more than ever. For individual users, relying on memory is no longer realistic. We have multiple social media accounts, bank accounts, email accounts, and other accounts on different websites. Remembering 15-20 complex passwords isn’t easy for most people. A password manager allows people to use long, unique passwords for every account without friction. They generate strong, unique passwords for every account and store them securely. Users only need to remember one master password. This removes the habit of reusing the same password or adding “123” at the end just to make it work. NordPass, Dashlane, and Keeper are some good password managers.

Password managers also help reduce damage when breaches happen. If one site is compromised, the same password cannot be used elsewhere. In today’s environment, that separation matters more than ever.

For businesses, the challenge is bigger. Traditional password rules focus on how passwords are created, not on whether those passwords are already exposed. The report makes it clear that this approach is outdated. Organizations need tools that continuously monitor leaked and stolen credentials and block them before attackers can reuse them. This is especially important for VPNs, cloud accounts, service accounts, and legacy systems that still rely on passwords.

Identity security also needs to be layered. Strong passwords alone are not enough. Phishing-resistant multi-factor authentication, regular credential audits, and visibility into exposed passwords should be treated as basic security hygiene, not advanced features.

Looking ahead, this problem is unlikely to fade. Infostealer malware works because it scales quietly and efficiently. Attackers no longer need to break in. They can simply buy access that was already stolen. As this market grows, identity and access security will become more important than network-level defenses.

The report makes it clear that passwords are not failing because users are careless or uninformed. They are failing because the internet now runs on stolen credentials traded at scale. Until individuals and organizations adapt to that reality and invest in better tools and habits, weak passwords will remain one of the easiest ways in.