Insight Articles: Identity Security Risk Series – Your Employees’ Passwords Are Already for Sale
For Business Owners, CIOs & CISOs [8-minute read]
Your Employees’ Passwords Are Already for Sale. Now What?
3.1 billion passwords were stolen and traded in 2024. Are your credentials compromised? And what you’ve done about it.
There is a reasonable chance that at least one of your employees’ work credentials is currently for sale on a dark web marketplace. This is not a theoretical risk. It is an active criminal economy where stolen credentials are bought, sold, and used to gain unauthorized access to business systems.
In 2024, 3.1 billion passwords were collected, traded, and sold, a 125% increase over the previous year. The surge is not simply the result of more data breaches. It reflects a sophisticated underground marketplace that has become remarkably efficient at harvesting, aggregating, and monetizing stolen credentials.
Your objective is not to prevent every password from being stolen. That’s unrealistic. You need to ensure a stolen credential cannot be used to compromise your business.
The Anatomy of a Credential Breach
70%
Of people reuse passwords across multiple accounts – including work accounts – after a personal account is compromised
3.1B
Passwords stolen and traded on dark web marketplaces in 2024 – 125% more than the prior year
17.3B
Session cookies available to attackers – bypassing both passwords and MFA by presenting an already-authenticated session
91%
Of organizations experienced at least one identity-related security incident in the past year
Credential-based attacks succeed because they exploit two common human behaviors: password reuse and convenience. When an employee uses the same password for a personal account and a business account, a breach of one can become a breach of the other.
The attacker never needs to exploit your network. They simply use a password your employee has already given them elsewhere.
How a Credential Attack Unfolds:
1
A breach occurs elsewhere
A consumer or SaaS platform your employee uses is compromised. Their email address and password are stolen. They never know it happened, or they don’t change the password.
2
The credentials are sold
The stolen credentials are added to massive breach databases containing billions of records and sold on dark web marketplaces.
3
Automated attacks begin
Attackers use credential stuffing tools to test those usernames and passwords against Microsoft 365, Salesforce, VPNs, cloud platforms, and other business applications.
4
A login succeeds
One password works. The attacker now has legitimate access to your environment and appears to be an authorized user.
5
The breach expands
From that initial foothold, the attacker explores connected systems, escalates privileges, and accesses sensitive data before anyone realizes they’re there.
The average attacker remains undetected for 241 days. That’s nearly eight months to learn your environment, identify high-value systems, and steal data using nothing more than a compromised credential.
The MFA Misconception
Many executives believe that implementing multi-factor authentication (MFA) solves the credential problem. It doesn’t. It dramatically reduces the risk, but it doesn’t eliminate it.
MFA is highly effective at stopping traditional password-based attacks. An attacker with only a stolen password will often be unable to authenticate. That’s why MFA remains one of the most important security controls every organization should deploy.
However, attackers have adapted. Techniques such as MFA fatigue attacks, SIM swapping, and real-time phishing proxies are designed to bypass or defeat the second factor.
There is another challenge: session cookies. A stolen session cookie represents a user who has already authenticated. If an attacker steals that session, they can often gain access without entering a password or responding to an MFA challenge.
MFA remains essential. But protecting identities today also means protecting authenticated sessions, detecting unusual behavior, and assuming that some credentials will eventually be compromised.
“Requiring MFA is necessary. It is not sufficient. The organizations that stopped at MFA are the organizations that are surprised when credential-based breaches still happen to them.”
Case Studies
What an Effective Credential Security Program Looks Like
No single control can stop every credential attack. Effective credential security relies on multiple layers of protection, detection, and response.
Prevent credential misuse:
- Enforce MFA for every user
- Use phishing-resistant MFA for privileged and high-risk accounts
- Require single sign-on (SSO) for sanctioned applications
- Mandate password managers for all work accounts
- Deploy endpoint detection on every device accessing corporate systems
Detect compromised credentials:
- Continuously monitor the dark web for exposed credentials
- Detect and block credential stuffing attacks
- Monitor for anomalous logins based on location, device, and behavior
- Detect suspicious sessions and require re-authentication
- Continuously evaluate risk and revoke active sessions when necessary
One of the biggest gaps in most organizations is dark web credential monitoring. Most businesses have no way of knowing when an employee’s credentials have been compromised. They only discover the problem after an attacker attempts to use them, or after a breach has already occurred.
Monitoring exposed credentials shifts the advantage. Instead of reacting to an incident, your security team can reset passwords, invalidate sessions, and reduce risk before stolen credentials become a successful attack.
The Insurance and Audit Dimension
Credential security is no longer just an IT concern. It has become a key focus for cyber insurers, regulators, and external auditors. Cyber insurance applications routinely ask whether MFA is enforced for all users, remote access, and privileged accounts. Inaccurate responses can jeopardize coverage or complicate claims after an incident.
Auditors are also paying closer attention. Frameworks such as SOC 2 Type II expect organizations to demonstrate strong identity controls, including MFA, access management, and user lifecycle governance.
Organizations that treat credential security as a compliance checkbox often discover the gaps only after an audit finding, an insurance dispute, or a security incident. Those that address it proactively are better positioned to satisfy all three.
The Question to Ask Right Now
If one of your employees’ passwords was compromised tomorrow, would you know? Do you have monitoring in place that would alert your security team before an attacker uses that credential to access your systems?
Find Out Whether Your Credential Security Has Real Gaps
Our Identity Security Gap Analysis includes a dedicated section on credential security and MFA. Six questions reveal whether your controls are comprehensive or whether you have coverage gaps that leave you exposed.
How Exposed Is
Your Company?
Uncover hidden risks across privileged accounts, credentials, vendor access, MFA, session monitoring, and compliance controls. Take our 5 minute Gap Assessment to see where your biggest security gaps may be hiding.
