What would happen if someone got hold of one of your employees’ passwords from years ago?
Not one they’re using today.
Not one they even remember.
Just an old login that was never properly retired.
That’s exactly how a recent large-scale data theft campaign unfolded.
A cyber security investigation revealed that sensitive business data from organisations around the world had been quietly accessed and later sold on the dark web.
Different industries. Different countries. Different business sizes.
But the same gap kept appearing.
Every affected organisation allowed access to critical systems using only a username and password.
No second step.
No additional verification.
Just enter credentials and you’re in.
That single decision created a shared vulnerability across every business impacted.
The passwords weren’t guessed.
They were collected using infostealing malware. A type of malicious software that can quietly infect a device without the user knowing.
Once active, it captures saved passwords, login details, and other sensitive information, then sends it back to attackers.
This doesn’t just happen on office machines.
Any device used to access work systems can become a risk:
And once those credentials are stolen, they don’t always get used straight away.
Some of the passwords used in this campaign were years old.
That highlights two critical gaps:
This is what security professionals refer to as a latency issue.
The risk doesn’t disappear.
It waits.
An exposure from years ago can become a breach today.
In every case, the attackers had valid login details.
What they didn’t have was a second factor.
Multi-factor authentication (MFA) requires users to verify their identity using something beyond a password. This could be:
Without that second step, access is denied.
That means even if credentials are stolen, they can’t be used.
This is why the guidance hasn’t changed.
Passwords on their own are no longer a reliable form of protection.
Yes, MFA adds an extra step. But it also removes the value of stolen credentials entirely.
Security is no longer about keeping passwords secret.
It’s about ensuring they’re not enough on their own.
Old passwords don’t expire on their own. They stay active, trusted, and exploitable.
MFA closes that gap instantly.
If you’re not enforcing it across your business yet, now is the time.
Don’t wait for an old credential to become a real incident. Get in touch and we’ll help you put the right controls in place.
