New reports show attackers using passwords and keys that were reused or never changed. Here are 9 simple steps to replace them.
Several reports this week show attackers getting in with passwords and keys that were reused or never changed. The bottom line: change any password you have used in more than one place, and replace old keys and logins sitting in old emails or files. The tips below show you how, one step at a time.
What the reports found
Here are the key facts from four recent reports.
- Chainstack, a company that runs blockchain systems, said an attacker reached a database with customer names, email addresses and password hashes, as reported by The Hacker News. A password hash is a scrambled copy of a password. The company asked customers to update passwords, including on other services where they used the same one.
- CrowdStrike said a China-linked group used AI agents against more than 200 organizations in 11 days, according to Help Net Security. In one case, the attacker used login keys from a 2022 file that had likely never been replaced. The attacker also used a key from a 2024 email leak.
- An attacker took over the update system of a security tool called cPGuard and used it to collect password hashes, The Hacker News reported. The maker said weak, common or leaked passwords can be figured out from those hashes. It said even strong ones still need resetting.
- Security firm ESET found a group sending email attachments dressed up as fines and tax notices, Help Net Security reported. The group's tool took saved browser passwords, VPN settings, and files.
Tips for you and your family
1. Change any password you reused
Make a short list of accounts that share the same password. Change each one to its own new password. Start with email and banking.
2. Make new passwords long and uncommon
Weak or common passwords can be guessed from a stolen hash. Use a long phrase that only you would think of. Never reuse an old password that may have leaked.
3. Be careful with surprise fine or tax notices
ESET found attackers using fake fines and tax notices as bait. In one case, the email came from a real government account that had been taken over. If an attachment surprises you, contact the sender another way before you open it.
4. Keep your file tools up to date
One attack used a flaw in WinRAR, a program that opens zip-style files. It showed a harmless PDF while hiding a file that ran each time the computer started. If you use WinRAR, check that it is up to date.
Tips for travelers
5. Clean old VPN files and keys out of your email
A VPN is a tool that makes a private link to a network. In one case, the attacker found VPN settings in a person's sent mail. Search your inbox and sent folder for old setup files and keys. Delete what you no longer need, and ask for new ones if old ones were shared by email.
6. Expect fake emails after a breach notice
Chainstack asked customers to stay alert for phishing after its breach. Phishing means a fake message that tries to trick you. If you get a breach notice, go to the company's website yourself instead of clicking links in follow-up emails.
Tips for small businesses
7. Replace keys even if nobody saw them
Chainstack said it had no evidence some keys were read. It still treated them as exposed and asked customers to replace them. To "rotate" a key means to swap it for a brand new one. Do this for any key or password that may have been in reach.
8. After a security update, still change passwords
The cPGuard maker said the fixed version removes the hidden back door. But copied passwords and keys may still work after the update. Update first, then reset every password and key on affected servers.
9. Update device software and hide admin pages
Barracuda shared two flaws that, used together, could give an attacker full control of some devices, according to The Hacker News. The company said devices whose admin pages are not open to the internet are less at risk. It also said devices that are several versions behind may need more than one update. Check your firewall and email security devices today.
A simple habit to keep
These reports share one lesson. A password or key does not expire on its own. A file from years ago can still open a door today.
Pick one day each season to review your logins. Change anything reused, delete old keys from email, and run your updates. It takes a short time, and it closes doors you may have forgotten were open.
Have a question about anything here? Email me at sales@appwt.com or call (888) 565-0171, and I will answer it.
Sources
- Chainstack Reports Production Systems Breach Exposing Customer Data and Password Hashes, The Hacker News, 2026-11-03
- AI agents scale and speed up Chinese-linked attacks, Help Net Security, 2026-11-03
- cPGuard Update Channel Hijacked to Backdoor Linux Servers and Collect Password Hashes, The Hacker News, 2026-11-03
- Gorbag APT group hits Ukrainian courts and city councils with self-deleting malware, Help Net Security, 2026-11-03
- Barracuda Flaws Could Be Chained to Bypass Authorization and Gain Root Access, The Hacker News, 2026-11-03
Tags
Frequently Asked Questions
What is a password hash?
It is a scrambled copy of your password that a company stores. Weak, common or leaked passwords can still be figured out from a hash by guessing.
If a company fixed the problem, do I still need to change my password?
Yes. The cPGuard maker said copied passwords and keys may still work after its fix. Reset them anyway.
What does it mean to rotate a key?
It means replacing an old key or password with a brand new one. Chainstack asked customers to do this even without proof the keys were read.
Is an attachment safe if it comes from someone I know?
Not always. ESET found one fake notice sent from a real government account that had been taken over. Check with the sender another way first.
Enjoyed this article?
Share it with your network
