Two hours that decide whether your accounts survive a breach

wlyu-333 — Fri, 23 Oct 2026 17:07:40 +0000

When a service you use is breached, the leaked file is almost never a single password. It is a table: an email address, a password hash, sometimes a session token, sometimes a phone number. The damage is not done the day the file leaks. It is done over the following weeks, when that table is tried against every other service where you might have reused the same credential.

This is why "change your password" is the wrong first instruction. The correct first instruction is to ask a different question: which of my accounts, if taken over, would let someone take over everything else? For most people there are three, in this order — the email account that receives password resets, the account that holds their payment details, and the account that holds their recovery phone number.

The work is therefore ordered, not counted. First: put multi-factor authentication on the recovery email account, because it is the one that resets the others. Second: install a password manager and let it generate unique credentials, beginning with those three accounts rather than sweeping everything at once. Third: check what an attacker would find if they tried to recover your account — an old phone number, a security question whose answer is on your public profile, a backup email you no longer use.

Two hours, spent in that order, closes far more risk than two weeks spent changing passwords alphabetically.

DEV Community: wlyu-333

Two hours that decide whether your accounts survive a breach