How to reset account passwords after falling victim to password reuse?

Question

I recently had one of my accounts compromised after falling victim to an online phishing scam. To make matters worse, while I've used unique passwords for any account created in the past few years, my 14 year-old self made the critical mistake of reusing passwords between multiple accounts.

Since then, I have received emails from several sites warning me of login attempts from unauthorized sources. To keep my account secure, I'm now faced with the arduous task of resetting passwords for nearly 280 different accounts.

I've attempted to use LastPass's Automatic Password Reset, but have had limited success. It requires manually checking which sites are supported, lacks an option for resetting multiple accounts at once, and sometimes fails to register successful password resets.

How should I go about resetting multiple account passwords after a security breach?

Answer 1

Since there are many different ways in which password reset functions can be implemented, the only real option is spending some time going through resetting them manually. Yes, it's a pain, but once you're done, you're not going to be worried about the same problem again.

At the very least, prioritise accounts - if you've not used them for years, there is probably less urgency than for something you use regularly, or your email account, for example.

Answer 2

Start by making a list of most important accounts. You say you have 280 accounts. How do you know this? Do you already have a list?

What I would do is the following:

a) Change the password for accounts that you use for authentication. For example, a main email address where you receive password reset mails. Or if you use your phone for two-factor, change the password that you use to log in to your phone provider's website. Make good passwords, store it in a password manager, but also remember them.

https://www.schneier.com/blog/archives/2007/01/choosing_secure.html

b) Change passwords for really important stuff. Things that involve money or access to really valuable resources, like your bank account, or your AWS cluster, etc. Try to remember accounts that are linked to your money, such as software for games, or an app store. Make good passwords and remember them, or generate them using your password manager if you can reset the password, and store the password in the password manager in both cases.

c) Go change accounts for social media and other stuff that holds your personal information.

d) Continue going from important to unimportant until you get bored. Eventually, for the unimportant stuff that doesn't really hold value, you can either reset the password when you bump into wanting to use the account, or just make a new one.

Now I don't want to make you paranoid, but you might want to add a simple virus scan before changing things. I don't know what kind of phishing trap you walked in to, but you should change passwords from a clean device if you got infected with malware.

Last but not least: activate two-factor where possible.

Answer 3

I ended up using LastPass's Security Challenge to help me identify weak and reused passwords between different sites.

I still had to take the time to manually change my password on each site, but LastPass saved me a lot of time listing which passwords needed to be changed.