Cybersecurity Expert Warns of 'Widespread Epidemic' of Bad Passwords

Cybersecurity experts are sounding the alarm on what has been referred to as a "widespread epidemic" of weak passwords that could leave their data, accounts, and personal information at risk.

Cybernews recently conducted a study looking into more than 19 billion newly exposed passwords after several high-profile breaches in the past year. The outlet's research team wanted to examine the 2025 password creation trends.

What they uncovered in the data was quite alarming, to say the least.

The research found that 94 percent of passwords are reused, leaving Internet users vulnerable to exposure if even one of their passwords was exposed.

Additionally, almost a third of the passwords analyzed consisted of only lowercase letters and digits, making them easier to guess, and default and lazy passwords like “password”, “admin”, and “123456” are still a common pattern.

You can read the full study here.

"We’re facing a widespread epidemic of weak password reuse. Only 6% of passwords are unique, leaving other users highly vulnerable to dictionary attacks. For most, security hangs by the thread of two-factor authentication—if it's even enabled,” warned Neringa Macijauskaite, an information security researcher at Cybernews.

In response to these concerning findings, the Cybernews research team shared a few recommendations:

• Use Password Managers. They create and store unique, strong passwords for every service, reducing the temptation to reuse passwords across different platforms.
• Never reuse passwords. Make sure your password is at least 12 characters long, includes uppercase, lowercase letters, numbers, and at least one special symbol. Skip any words, names, sequences, or other recognizable strings.
• Enable multi-factor authentication (MFA) wherever possible. MFA provides an extra layer of security, reducing the risk of unauthorized access even if passwords are compromised.
• Organizations should enforce password policies that require passwords to be at least 12 characters long, ideally 16, incorporating a mix of uppercase and lowercase letters, numbers, and special characters. Complexity beats length.
• Organizations should ensure that adequate data hashing algorithms and configurations are implemented while continuously reviewing existing security standards revolving around data transit and storage.
• Review access controls regularly and perform regular security audits. This leads to a better security posture of a company and lowers the risk of its users’ personal data being leaked.
• Monitor and react to credential leaks. Organizations should adopt tools and platforms that can detect leaked credentials in real time, allowing them to instantly block access or require resets for affected accounts.

With hackers and cybercriminals getting more and more sophisticated everyday, it's important to keep your data and accounts secure.