Guide · Password managers
One reused password can unlock everything
Affiliate disclosure: This page contains affiliate links, which are labeled. If you buy through one, Small Biz Cyber Guide may earn a commission at no extra cost to you. Recommendations are not for sale. See the full affiliate disclosure.
Everyone reuses passwords, because everyone has dozens of accounts. The trouble starts when one of those sites gets breached. Attackers load the leaked email-and-password pairs into automated tools and try them against email, banking, payroll, Microsoft 365, and every other login they can find. Nobody “hacked” your bank. The old password just still worked.
That attack is called credential stuffing, and it’s cheap to run at scale. This guide is the companion to our Short on password reuse. It shows how to check your team’s exposure for free, what to fix first, and how to keep reuse from creeping back.
Recent breach of this type: Domino's customer accounts taken over with passwords leaked from other sites (disclosed ). No Domino's systems were hacked. Reused passwords from other breaches were enough to get in. What happened and what to do →
Quick verdict
- Check every work email on Have I Been Pwned today. Single-address searches are free, and so is monitoring a whole domain with up to 10 breached addresses, per the HIBP plans page.
- Fix in order: email first (it resets everything else), then banking and payroll, then your domain registrar and admin consoles.
- End reuse for good with one generated password per account in a team password manager, plus MFA on the accounts that matter.
Worth piloting: NordPass Business
Its admin panel includes a Data Breach Scanner that watches your company domain and a Password Health view that flags weak, old, and reused passwords. Run it alongside the Have I Been Pwned check below to see where you stand.
Why one breach becomes your problem
Breach dumps get traded and re-sold for years. A password an employee used for a forum in 2019 can still be sitting in a list that gets tried against your Microsoft 365 tenant today. The attacker doesn’t need to know anything about your company. They only need one person who used the same password twice.
Two things break the chain: a unique password per account, so a leak at one site opens nothing else, and MFA, so a correct password alone still isn’t enough. Most small businesses have neither everywhere, and that’s why this one is worth an afternoon.
Check your exposure on Have I Been Pwned
Have I Been Pwned (HIBP) is a free breach-lookup service run by security researcher Troy Hunt. Here’s what each check tells you.
| Check | What it tells you | Cost |
|---|---|---|
| Email search | Which known breaches include one email address | Free |
| Notify me | An email alert when that address shows up in a future breach | Free |
| Domain search | Every breached address on your company domain, after you prove you control it | Free up to 10 breached addresses; paid plans above that (check current pricing) |
| Pwned Passwords | Whether a password appears in breach data | Free (best used through your password manager’s breach report) |
- List every work address, including shared ones like info@, billing@, and an old office@ nobody checks.
- Search each address, or verify your domain once for domain search so you see them all together.
- Write down each breached site and date. If the password used there was ever used anywhere else, that account goes on the fix list.
- Turn on notifications so the next breach comes to you instead of an attacker finding it first.
A hit doesn’t mean someone is in your account right now. It means that password should be considered public. Treat it that way.
Fix reused passwords in this order
- Email. Password resets for everything else go through it. Change the password and turn on MFA (see MFA for Microsoft 365).
- Banking, payroll, and payment processors. These are where money actually moves.
- Your password manager’s master password, if you already have one and it was ever reused.
- Domain registrar and DNS host. Whoever controls these controls your email and website.
- Admin consoles: Microsoft 365 or Google Workspace admin, accounting software, and your website CMS.
- Everything else, as you move each login into the vault.
Stop reuse from coming back
People reuse passwords because remembering dozens of unique ones is impossible. Take memory out of it: a team password manager generates and fills a unique password for every site, and its health report flags reuse before an attacker finds it. NordPass Business calls this Password Health. 1Password calls it Watchtower. Bitwarden includes reused and exposed password reports in its vault health reports.
| Option | Reuse and breach checks | Link |
|---|---|---|
| NordPass Business | Password Health plus a Data Breach Scanner for your company domain | NordPass Business pricing Affiliate |
| 1Password Business | Watchtower flags reused, weak, and compromised passwords | 1Password Business pricing |
| Bitwarden Teams | Vault health reports for reused and exposed passwords | Bitwarden business pricing |
Only the NordPass link above is an affiliate link. For a full comparison, see password managers for small business and 1Password vs Bitwarden Teams. If your team saves work passwords in the browser today, start with browser-saved passwords are not a business vault.
Bottom line
A reused password is only as safe as the weakest site you ever used it on. Check your team on Have I Been Pwned, fix email and money accounts first, and then make unique, generated passwords the default so this never piles up again.
Prefer video? Watch the under-a-minute version on YouTube: One Reused Password Can Unlock Everything.
Free next step: Get the Small Business Cybersecurity Checklist — download it now, or sign up there to get it by email and hear about new guides.
Turn “unique passwords” into a written rule. The Small Business Security Essentials Toolkit ($79) includes a Password & MFA policy that requires unique passwords, a Self-Assessment that scores password reuse, and the Offboarding Checklist for rotating anything a former staff member could see.