Does anyone know of any study or any data whatsoever which might indicate how many users actually change their passwords after they have been notified that their credentials appeared in a breach?

  • Can we assume that you mean web services and not corporate accounts? – schroeder Nov 22 '19 at 19:48
  • Have you looked this up? I'm finding hits ... zdnet.com/article/… – schroeder Nov 22 '19 at 19:49
  • That google study is only if a user attempts to use a previously compromised password, not whether or not they changed it after they had been notified that their personal account credentials were compromised. Yes this is all in reference to web services. – john doe Nov 22 '19 at 19:53
  • I'm not sure how you are concluding that. The Google paper is about changes after being notified, as tracked by their extension. – schroeder Nov 22 '19 at 20:27
  • I'd hope that it would be a best practice for the provider to force users to pick a different password - to actually compare old and new and require that the new password be different, as a one-time assurance activity (at which point the answer to your question would be a cheery "100%!" ;) But I can see why some orgs might choose otherwise, though. – Royce Williams Nov 22 '19 at 21:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.