Credential leaks present a silent, retroactive risk that bypasses modern security upgrades. If a user previously reused a password across multiple services, a leak of that password from one service retroactively compromises all other accounts sharing that credential, even if the user has since adopted unique passwords, password managers, or two-factor authentication (2FA) for their primary accounts. ## Mechanics of Retroactive Exposure When a historical database is exfiltrated and later cracked or published, the exposure of stale credentials triggers several risk vectors: - **Forgotten Accounts:** Legacy or low-value accounts created years prior remain quietly active and vulnerable if their passwords were never updated. - **Aggregated Social Engineering:** Attackers compile minor personal details and credentials across multiple minor leaks to build comprehensive profiles for escalation. - **Targeted Dictionary Attacks:** Leaked email lists provide heuristics (such as domain patterns like Yahoo or Hotmail) that allow attackers to refine and target dictionary attacks. Identifying these compromises relies on public breach-tracking services like Have I Been Pwned (HIBP), which compile leaked user data to alert affected individuals. **Cross-Domain Connections**: [[Network Firewalls Cannot Stop Credential Theft]], [[Cascading System Failures]] ## Source - [[The Dropbox Hack is Real]] — Hacker News, August 2016 — https://news.ycombinator.com/item?id=12392745