While everyone and their favorite webcomic seems to agree that password reuse is a major problem, some quick googling cannot seem to find any cases where it has been used on a large scale in an attack. Thus I ask, has there actually been any occurrences of a large-scale breach made possible by password reuse? If not, why hasn't there been any?

closed as too broad by schroeder, M'vy, Gilles, Xander, Iszi Jul 13 '15 at 18:13

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 3
    Why do you want evidence of "large scale" attacks? There wouldn't, just the individual accounts... – schroeder Jul 13 '15 at 3:45
  • This is shaping up to be a collection of anecdotes, which isn't what we do here. One more anecdote: from a Stack Exchange founder – Gilles Jul 13 '15 at 9:54
  • @schroeder I could picture someone breaching a database where passwords are stored in plaintext alongside emails and using those combinations to breach many of the email accounts themselves. Which is an attack using password reuse and could be considered "large scale". – majorROM Jul 13 '15 at 12:35
  • But, that wouldn't be considered a single "large scale" attack but a lot of little ones. – schroeder Jul 13 '15 at 14:59

The attack against HBGary is a famous example of an attack made easier by password reuse:

Neither Aaron nor Ted followed best practices. Instead, they used the same password in a whole bunch of different places, including e-mail, Twitter accounts, and LinkedIn. For both men, the passwords allowed retrieval of e-mail. However, that was not all they revealed. Let's start with Ted's password first. ... his ssh password was identical to the cracked password he used in the CMS. This gave the hackers immediate access to the support machine.

I don't know if you consider this attack large-scale, but it was definitely large impact to compromise a famous security firm, publish its internal emails etc.

  • This seems like a fairly good example, although it appears there was more errors than just password reuse. – majorROM Jul 12 '15 at 21:17
  • 2
    @majorROM: you rarely find only a single indicator for bad security. If somebody reuses critical passwords it is very likely that this is not the only security problem. – Steffen Ullrich Jul 12 '15 at 21:51

Recently there has been the case of the Cardinals being Investigated for Hacking Into Astros’ Database.

Investigators believe that Cardinals personnel, concerned that Mr. Luhnow had taken their idea and proprietary baseball information to the Astros, examined a master list of passwords used by Mr. Luhnow and the other officials when they worked for the Cardinals. The Cardinals employees are believed to have used those passwords to gain access to the Astros’ network, law enforcement officials said.

That tactic is often used by cybercriminals, who sell passwords from one breach on the underground market, where others buy them and test them on other websites, including banking and brokerage services. The breach on the Astros would be one of the first known instances of a corporate competitor using the tactic against a rival. It is also, security experts say, just one more reason people are advised not to use the same passwords across different sites and services.

Not the answer you're looking for? Browse other questions tagged or ask your own question.