I recently had one of my accounts compromised after falling victim to an online phishing scam. To make matters worse, while I've used unique passwords for any account created in the past few years, my 14 year-old self made the critical mistake of reusing passwords between multiple accounts.

Since then, I have received emails from several sites warning me of login attempts from unauthorized sources. To keep my account secure, I'm now faced with the arduous task of resetting passwords for nearly 280 different accounts.

I've attempted to use LastPass's Automatic Password Reset, but have had limited success. It requires manually checking which sites are supported, lacks an option for resetting multiple accounts at once, and sometimes fails to register successful password resets.

How should I go about resetting multiple account passwords after a security breach?

3 Answers 3


Since there are many different ways in which password reset functions can be implemented, the only real option is spending some time going through resetting them manually. Yes, it's a pain, but once you're done, you're not going to be worried about the same problem again.

At the very least, prioritise accounts - if you've not used them for years, there is probably less urgency than for something you use regularly, or your email account, for example.


Start by making a list of most important accounts. You say you have 280 accounts. How do you know this? Do you already have a list?

What I would do is the following:

a) Change the password for accounts that you use for authentication. For example, a main email address where you receive password reset mails. Or if you use your phone for two-factor, change the password that you use to log in to your phone provider's website. Make good passwords, store it in a password manager, but also remember them.


b) Change passwords for really important stuff. Things that involve money or access to really valuable resources, like your bank account, or your AWS cluster, etc. Try to remember accounts that are linked to your money, such as software for games, or an app store. Make good passwords and remember them, or generate them using your password manager if you can reset the password, and store the password in the password manager in both cases.

c) Go change accounts for social media and other stuff that holds your personal information.

d) Continue going from important to unimportant until you get bored. Eventually, for the unimportant stuff that doesn't really hold value, you can either reset the password when you bump into wanting to use the account, or just make a new one.

Now I don't want to make you paranoid, but you might want to add a simple virus scan before changing things. I don't know what kind of phishing trap you walked in to, but you should change passwords from a clean device if you got infected with malware.

Last but not least: activate two-factor where possible.

  • I have a complete list of accounts stored via LastPass. My LastPass password is unique and has never been reused.
    – Stevoisiak
    Jul 5, 2017 at 21:01
  • Neat. I would go through it, and categorize all accounts that use the compromized password into the four categories I mentioned. Then change them accordingly. Jul 5, 2017 at 21:06
  • 1
    "Make good passwords, store it in a password manager, but also remember them." The memory part isn't realistic for a human with 280 accounts.
    – PwdRsch
    Jul 5, 2017 at 23:02
  • That's only for the critical accounts PwdRsch. Jul 6, 2017 at 9:14

I ended up using LastPass's Security Challenge to help me identify weak and reused passwords between different sites.

I still had to take the time to manually change my password on each site, but LastPass saved me a lot of time listing which passwords needed to be changed.

LastPass Security Challenge

  • I don't understand how this helped you. You said you reused passwords between accounts, so presumably you had to change all passwords on all accounts where you did this. How specifically did LastPass' Security Challenge make that easier for you?
    – PwdRsch
    Jul 20, 2017 at 15:33
  • 1
    @PwdRsch I only reused passwords on my older accounts. I used unique passwords for any account created in the past 4 years. LastPass helped me track how many passwords still needed to be reset. It's not a complete "solution", but it may be helpful for others in a similar situation.
    – Stevoisiak
    Jul 20, 2017 at 15:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .