Abusing Credentials — Recycled Passwords at Work

Username-password pairs leaked in past breaches trade on underground markets for years, fueling login attempts against other services. The NPA observed roughly 13,700 suspicious accesses per day in H1 2026 — up about 50% year on year — signaling intensified attack preparation including vulnerability reconnaissance. Credential attacks and vulnerability attacks are linked.

Password reuse is what makes this work. For the user, one service's breach becomes a master key to every account in their life. Several autumn 2026 Japanese disclosures included leaked member passwords (hashed and otherwise) and warned about reuse damage.

MFA helps, but MFA fatigue (endless push notifications) and AiTM phishing can defeat it. The global recommendation is not "MFA is enough" but moving to phishing-resistant authentication.

Credential attacks run on past leaks, so damage is never one-and-done. The mass of email addresses and passwords (including hashes) leaked in Japan's autumn 2026 wave will feed stuffing for years. Companies that leaked owe users password resets and session token revocation.

For individuals, the highest-leverage moves are a password manager and FIDO2/passkeys on critical services. For organizations: continuous monitoring for leaked credentials (dark web monitoring) and conditional access that distrusts unfamiliar environments.