Nearly ten billion passwords were published in one file. What that teaches us about identity security and the controls that still work.
The RockYou2024 compilation collected billions of previously leaked passwords into a single list that attackers now use to try logins at scale.
Passwords alone no longer protect an account. Multi-factor authentication and phishing-resistant sign-in are the practical defence.
A leaked password is only dangerous if it is still in use somewhere. Staff who reuse passwords across personal and work accounts expose the business.
Accounts protected with a second factor resist password-list attacks almost entirely, which is why it is the first control we enable.
