Skip to content

Stop reusing passwords: what recent NordPass survey reveals

Inside the 2025 NordPass password reuse survey

To measure just how regular the habit of password reuse remains, NordPass commissioned an independent research team to conduct interviews with 1,727 adults—619 Americans, 605 Britons, and 503 Germans. The questionnaire dug into 3 areas:

  • How often people reuse logins.

  • How many passwords and accounts the habit affects.

  • Why they still do it in 2025.

United States

  • 62% of Americans confess they “often” or “always” reuse a password.

  • The median reuser juggles 3 core passwords that unlock about 5 different accounts.

  • Half say they do it because it is “easier to remember fewer passwords,” and 1 in 3 feel overwhelmed by the sheer number of services they use each month.

  • A troubling 11% see “no significant risk” in repetition—proof that experience, not warnings, drives behavior.

United Kingdom

  • 60% recycle logins.

  • Memory anxiety eclipses convenience: 40% fear they will lock themselves out if every password is unique.

  • Convenience and “too many accounts” tie for second place, and the same 11% shrug off the threat altogether.

Germany

  • 50% reuse passwords, the “best” score but still a coin toss.

  • Convenience is the main motive for 37% of German reusers, with 29% citing account overload.

  • 13% believe repetition is practically harmless.

Taken together, the data say one thing: roughly 57% of consumers across 3 advanced economies still bet on duplicate credentials. That is a majority large enough to keep credential‑stuffing operations profitable for years.

Why people still reuse passwords

Respondents fell into 4 overlapping camps when it came to explaining their password reuse habits:

  • The memorizers. About half of the Americans, 43% of the Britons, and 37% of the Germans who participated in the survey say they reuse passwords because it is “easier to remember fewer passwords.”

  • The overwhelmed. Around 30% in each country cite “too many accounts” to manage different passwords.

  • The anxious. Fear of forgetting unique logins peaks at 40% in the UK, 38% in the US, and 31% in Germany.

  • The skeptics. Between 11% and 13% have never had to deal with the consequences of being breached and assume the risk is overblown.

How cybercriminals take advantage of reused passwords

Reuse turns one leak into a chain reaction. If hackers steal your password from a single site, they can try the same login on every other service you use—email, banking, work apps—until one opens. That’s why password reuse matters. And the criminal economy around stolen logins is on an industrial scale. It moves fast. Once a breach hits the dark web forums and marketplaces, there are multiple ways for bad actors to profit from stolen and reused credentials.

  • Credential stuffing. Attackers equipped with vast quantities of reused credentials load millions of user-password pairs into botnets that fire automated logins. Even a 1% success rate nets thousands of working accounts.

  • Account takeover. A reused password—usually exposed in data breaches—that opens your email inbox lets cyber crooks reset everything else—cloud storage, cryptocurrency wallets, emails, etc. The initial foothold becomes a pivot point into higher‑value targets.

  • Social engineering. With control of social or business accounts, criminals study message history and craft believable requests: “Can you approve this invoice?” or “Forgot to pay the supplier—use this account.” Victims respond because the request comes from what would appear to be a trusted identity.

The role of businesses in preventing password reuse

Companies sit on both ends of the password reuse problem. They must protect their staff from careless habits, and shield customers whose credentials may already be up for sale on the dark web. There are a few ways organizations can tackle the problem.

Reject reused credentials

During the signup or password reset process, the site should check the proposed password against a breach database. If the string has appeared in past leaks—or looks identical to one already on file—the user sees an offer to choose something stronger. Also, embedding a one‑click password generator would remove friction.

Layer authentication

Multi‑factor authentication stops automated takeover even when credentials leak. A growing number now leapfrog passwords altogether by offering FIDO passkeys — device‑bound cryptographic secrets that can’t be reused or phished.

Security training

Companies that run frequent, hands‑on security workshops experience far fewer cases of employees reusing credentials. Demonstrating how quickly a single compromised login can ripple through an entire network makes it clear that password reuse is a very bad habit.

Password manager adoption

Many companies now encourage—or even require—the use of business password managers. When staff have a secure vault for their logins, they’re far less likely to recycle passwords. Most vaults also include built-in password generators that create strong, random strings on demand, taking the guesswork out of crafting robust credentials.

How to stop reusing passwords

To effectively break the habit of password reuse, all you need is a workflow that treats strong, unique credentials as the default rather than the exception. Here are some pointers on how you can do that.

Adopt a password manager

Tools like NordPass generate, sync, and autofill passwords across devices. The user remembers one Master Password; the vault remembers the rest. A built-in Password Generator produces random, high‑entropy strings at the click of a button, eliminating the temptation to ring in the new year with P@ssw0rd2026.

Consider passkeys

A passkey pairs public‑key cryptography with device biometrics, so there’s nothing to type, nothing to forget, and nothing to reuse. Many major platforms already support them; our What is a passkey? explainer walks you through setting one up for the first time. Where passkeys are unavailable, turn on MFA to add a second check that attackers can’t guess from a breached list.

Audit dormant accounts

Old forums, shopping sites you used once for a novelty gift, that abandoned fitness‑tracking app—each is a latent vulnerability if it shares credentials with active services. Close the account, or at least reset the password to something unique. Browse our annual list of the most common passwords for inspiration on what not to choose.

Final thoughts

Password reuse thrives on short‑term convenience and long‑term optimism. Our survey shows that 57% of users in 3 mature digital economies still rely on that optimism, even as criminals industrialize credential theft. The cure is hardly exotic: password managers, layered authentication, and a realistic assessment of risk. Breaking the habit doesn’t demand perfect vigilance, but rather a willingness to trade poor memory tricks for purpose‑built tools.

About NordPass
NordPass is developed by Nord Security, a company leading the global market of cybersecurity products.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

The changing DNA of organized crime in Europe: key insights from the 2025 EU-SOCTA

Organized crime is no longer out on the streets—it has seeped into the very fiber cables that keep the internet running, creating new hybrid and wholly virtual threats that require unprecedented strategies to tackle. In March, Europol published the 2025 EU Serious and Organized Crime Threat Assessment, or the EU-SOCTA. It revealed that the DNA of organized crime has been undergoing serious shifts, posing threats that may be more dangerous and destabilizing than ever before.

EU-SOCTA 2025 at a glance

The EU-SOCTA is a report issued by Europol every 4 years that assesses serious and organized crime activities in the EU and the evolution of criminal tendencies and practices. It serves as the foundation for the EU’s strategic approach toward tackling serious and organized crime.

The data is extracted from Europol’s investigations and contributions from other law enforcement partners around the globe. The EU-SOCTA helps decision-makers, whether at the governmental, business, or individual level, to set priorities and to effectively prepare for and combat serious threats.

Europol is the EU’s law enforcement agency, focusing on combating serious international crime and terrorism in all Member States. It collaborates with other EU agencies and international partners to strengthen global security cooperation and share intelligence on ongoing threats.

For the 2025 assessment, Europol gathered data from thousands of law enforcement investigations and used the expertise of EU agencies and international organizations to create the most comprehensive analysis of serious and organized crime to date.

Destabilizing the Union

The 2025 EU-SOCTA makes it clear—as the world evolves, so does the DNA of organized and serious crime. The online space has become its new home and facilitator, as criminals increasingly rely on the internet to conduct their activities.

Switching their primary headquarters to the digital world—spaces like the dark web, social media platforms, and e-commerce sites—allows criminals to utilize digital tools for more malicious attacks. Developments in the tech world facilitate speedier execution on a larger scale and make it harder to track down perpetrators, particularly those relying on decentralized blockchain systems.

The report names the destabilization of the EU as one of the biggest threats posed by serious and organized crime. Criminal organizations aim to reduce trust in the legal system and government through the spreading of violence, illicit proceeds, and corruption. They rely on digital innovations like AI to conceal their activities and make it harder to trace crime back to its source.

The offender profile: younger and more violent than before

As the way the crimes are committed shifts, so does the profile of the criminal. As the 2025-SOCTA reveals, the criminals are becoming younger, more tech-savvy, and more brutal than before. In an interview with NordPass in 2024, Adrianus Warmenhoven mentioned that people working for cybercriminals may not know the nature of their work, instead assuming they’re hired as IT consultants.

The report notes the exploitation of younger perpetrators to conduct illegal trade and commit crimes for a reward. Young recruits—including minors—are preferred as they’re more willing to conduct illicit activities without financial reward. Blackmail is often used to maintain this working relationship.

Criminals use end-to-end communication services to plan and execute their attacks. Encrypted channels make it harder to intercept communication and offer anonymity, IP obfuscation, rotating IDs, or automatic message deletion after a set period of time.

One aspect remains largely unchanged: financial interest. Criminal networks use illicit means to fund their operations, whether via corruption or money laundering. Some may be working for hire, receiving funding from larger organizations to disrupt society and conduct their activities.

Part of the shift is relying less on legal tender and more on cryptocurrencies to funnel illicit funds. Cybercriminals use blockchain technology to transfer the money as crypto, making it harder for investigators to track down or recover. Crypto technology has also been combined with malware to bolster cryptojacking, a type of attack where a device is infected and hijacked to be used as a crypto mining machine.

Threat actors tend to start with smaller misdemeanors, building up the damage over time, leading to the so-called woodpecker effect. By acting small at first, they make it harder to see the bigger picture and prevent illicit actions in the early stages of organized attacks.

As these acts grow in scale, so does the use of violence. The report notes that violence related to organized crime has spilled over into public places, with a new service model emerging. Violence-as-a-service sees actors working with state agents or criminal organizations to promote and provoke violence in EU Member States and outside their borders. It involves both physical and digital activities, such as extortion, blackmail, and psychological violence.

Hybridizing crime: the online spills into the offline

The report’s title, “The changing DNA of serious and organized crime,” hints at the big shift over the years as new types of hybrid threats emerge, mixing a variety of criminal activities to maximize profits and success rates.

Europol notes a close link between the increasingly hybrid nature of serious and organized crime and recent geopolitical tensions. The intersection of online and offline criminal activities, technological advancements, and the role of state and ideological actors in these crimes create more dangerous threats and unprecedented challenges.

For criminals, each technological development is a new opportunity to increase their toolkit and create new, unpredictable threats. The internet has done a massive service to cybercriminals, who now rely on the dark web or decentralized blockchain networks to obfuscate their activities, infiltrate their targets, and participate in illegal data trades.

Some serious crimes aren’t even conducted offline anymore—every step, from the initial idea to its execution, is 100% online. In fact, Europol notes that nearly all forms of serious and organized crime have a digital footprint.

Through hybridization, criminal networks act more as proxies on behalf of other organizations or even hostile states to destabilize the EU and weaken its economy. The report lists fraud, child sexual exploitation, migrant smuggling, cyberattacks, waste crime, and trafficking of illicit goods and weapons as some of the key activities facilitated by hybrid threat actors.

Cybercrime expertise has become a requirement. Ransomware attacks have proven to be profitable, targeting high-profile businesses or government agencies. Such attacks can impact essential services, particularly those in the public sector, further sowing distrust in institutions.

The (continuous) emergence of artificial intelligence

As with seemingly all things tech lately, AI is the name of the cybercrime game. Europol lists AI developments and quantum computing among the potential accelerators for serious and organized crime, particularly given the rapid developments in these fields.

Despite their relative novelty, AI systems like large language models (LLM) and generative AI have already been put to practical use by criminal networks. Through AI tools, criminals can improve their efficiency, act more seamlessly, and perform operations that are harder to prevent or combat.

Generative AI, in particular, has been helpful thanks to its low entry level. Any criminal can put in a prompt to create a script in their chosen language, which can then be used for spoofing, creating deepfake materials, or otherwise facilitating illicit activities. AI-powered voice notes and video materials pose a high risk of identity theft.

AI has also broadened the scope of attacks even further. Although online attacks were already far-reaching, AI requires fewer resources than previously observed. Some cybercriminals have been utilizing AI to brute-force more complex passwords, making credentials that were previously considered relatively resistant to threats vulnerable.

Although quantum computing is still relatively theoretical, criminals already operate with the anticipation of its eventual practical application. Access to quantum computing may pave the way for more efficient and sophisticated decryption technology, which would make data currently protected by encryption algorithms easier to breach.

The timeliness of AI is both its advantage and its downside for criminals. Its applicability is still relatively limited, and if illicit AI use increases, developers will likely implement preventative measures. Legislation will catch up, too, as legal entities are already starting to implement policies that regulate AI usage.

For-profit cybercrime flourishes

Europol notes the emergence of crime-as-a-service, where criminals act as corruption brokers and use digital tools for profit-driven operations. Corruption remains one of the biggest threats to businesses and government institutions, “embedded in the very DNA of crime.” Due to its massive impact on economic systems, corruption is interspersed in practically every form of serious and organized crime.

Criminals rely heavily on money laundering to procure funds. The infiltration of legitimate funds for money laundering is high-risk, high-reward. Transactions require an intricate system of hard-to-trace financial systems. However, the biggest operations can generate as much as billions of euros, making them an intrinsic part of serious and organized crime.

Crime-as-a-service is favored by state actors. It can help sanctioned states circumvent financial embargoes. In exchange for illicit services, criminals may receive a safe haven in the state that hired them. Criminals—particularly those working fully online—receive access to resources funded by the state to conduct disinformation campaigns or supply chain disruptions. This grants state actors plausible deniability, as attacks are conducted by proxy, and the state’s involvement may be too obscure to be proven.

Social media accounts have also been broadly utilized for serious and organized crime, especially on political grounds. Criminals may create fake social media accounts—often referred to as troll farms—to spread misinformation or propaganda, manipulate the newsfeed, and further instill doubt and confusion.

Cash-intensive businesses are the target

Although it may appear that government agencies are all criminals care about, small and medium-sized businesses are just as lucrative as targets for serious and organized crime. In fact, the report lists business email compromise fraud as one of the most effective ways to extract data.

According to the EU-SOCTA, all business sectors are potentially at risk of being infiltrated or exploited by criminals. However, the 3 most affected sectors are construction and real estate, hospitality, and logistics.

In some cases, data holds more value than money. It’s treated as a commodity and is at the forefront of illicit trade. Its value is in its reusability. Possession of valuable information puts a massive target on the potential victims’ backs. If stolen, strategically important data can be sold for espionage, economic advantage, or used for coercion.

Large-scale data breaches often involve login credentials dating 5 years back or older. This puts breached organizations in a particularly vulnerable situation—they may not know that their data has been compromised until years later, when a folder containing terabytes of sensitive information suddenly appears on a dark web forum.

Europol emphasizes that protecting the victims is essential to successfully tackling serious and organized crime. One key way to achieve this is cutting off the funding source for serious and organized crime at its root. Although recovering assets can be complicated, shutting criminals out from accessing them in the first place has proven to be effective. Asset recovery has proven to deter cybercriminals from pursuing further operations, as they can’t reintegrate stolen assets into the mainstream economy.

How can you improve digital defenses against serious and organized crime?

The 3 core pillars of the new DNA of serious and organized crime are:

  • Destabilization of society through illicit proceeds and the use of proxies.

  • Nurturing of crime in online spaces.

  • Acceleration of crime thanks to AI and other emerging technologies.

The 2025 EU-SOCTA can paint a grim first impression of the current threat landscape. However, the situation is not hopeless. This research doesn’t just help Europol discover malicious agents faster and with more precision—it indicates the potential future trends, allowing businesses and individuals alike to prepare for evolving risks.

For businesses concerned about serious and organized crime, one of the best ways to stay protected is to conduct transparent operations in accordance with legal requirements and compliance policies, such as ISO-27001, NIST, or NIS2. Upon detecting suspicious activities that could be caused by serious and organized crime actors, companies should contact their legal authorities immediately.

Employee education also goes a long way. Ensure your organization is practicing proper digital hygiene and adhering to a strong and flexible password policy and secure credential usage and sharing norms. Keep your team aware of emerging threats, common scam tactics, and risks posed by AI-powered technologies.

Hybrid problems require hybrid solutions, and Nord Security offers you exactly that. Start proofing your business against complex cybercrimes with a custom-tailored cybersecurity bundle of NordPass, NordStellar, and NordLayer.

  • NordPass is a password manager that helps organizations handle and share sensitive data without compromising its integrity.

  • NordLayer is a network security, threat detection, and response platform that integrates seamlessly with any technology stack.

  • NordStellar is a threat exposure management platform that monitors the dark web, helping organizations stay ahead of cyber threats.

 

About NordPass
NordPass is developed by Nord Security, a company leading the global market of cybersecurity products.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

How much money is your data worth?

If you had to put a price on your data—say, your ID number, or one of your social media passwords—what would you say it’s worth? Would it shock you to learn that, if it ever got leaked, it could be sold on the dark web for just a few bucks? Well, buckle up then… because it only gets worse.

It’s a black market, not an auction

We all think our data is super valuable—after all, it’s ours. Companies like Google and Facebook think so too, using it to personalize experiences, fine-tune algorithms, and make their ads more relevant. You’d probably assume that means your data is worth a lot of money, especially with everyone saying that “data is the new oil.” But the reality is that some of it might not hold much value to hackers on the dark web. How so?

The dark web is packed with tons of data being traded all the time. So if yours got leaked, it could just be another piece in the pile. That doesn’t mean it wouldn’t get picked up and used against you—it just means someone might not have to pay much for it. Harsh, we know, but true. With no rules or oversight in illegal markets, even the most sensitive info could sell for a shockingly low price.

What data is sold on the dark web?

The types of data you’ll find on dark web markets range from the obvious—like stolen passwords, business credentials, bank statements, credit card details, emails, bills, and ID cards—to the less expected, like user account activity, browsing history, utility bills, license plate numbers, and store receipts.

To put it differently, if there’s information about a person or a business that exists somewhere online, it can end up for sale on the dark web. It’s that simple.

The price tag on different types of stolen data

Cybercriminals price data depending on the type and what they can achieve with it. Therefore, in general, they place less value on passwords for personal social media accounts than on things like IDs or health insurance cards.

Not too long ago, experts at NordLocker analyzed a dark web marketplace to get an idea of the average prices for various stolen items. The table below shows their findings. Keep in mind, however, that there are at least 30 major dark web markets, and their listings are always being updated with new items and prices.

Type of dataAverage price
Bank statement$12.30
Utility bill$13.00
VPN account$12.90
Store receipt or invoice$10.00
License plate$100.00
Health insurance card$9.90
Check$98.00

To give you a few more examples: according to Privacy Affairs’ Dark Web Price Index, credit card details with an account balance of up to $5,000 sell for around $110 on the dark web. Crypto accounts range from $20 to about $2,500, while stolen logins to platforms like Spotify, HBO, Hulu, and Airbnb can go for as little as $1 to as much as $300.

Of course, most of this is personal data, but business and enterprise data is also being sold on the dark web. We’re talking digital items like API keys, RDP passwords, cloud infrastructure logins, and other things that could give hackers access to a company’s IT systems and sensitive information. And the prices? They can range from $500 to over $100,000, depending on the size of the targeted company and the potential impact.

Fact: cheap data can actually be worth more

What’s important to know—and also terrifying—is that the same piece of data can be worth much more than what it initially sells for on the dark web.

As explained by Daniel Kelley—a former black-hat hacker turned cybersecurity educator—in a recent AMA on Reddit, personal passwords for consumer accounts like Netflix usually go for just $5 to $25. However, if someone is reusing their Netflix credentials for something more valuable, like a work account or business platform, suddenly that $5–$25 password could be worth hundreds of thousands of dollars.

The point is, data that goes for next to nothing on the dark web can end up being a goldmine for cybercriminals. If those stolen credentials work across multiple business accounts or systems, it could cost attackers just a few dollars to cause millions in damage to targeted organizations.

How does your data end up on the dark web?

Cybercriminals have a few go-to methods for getting their hands on personal or company data and selling it on the dark web. One of the most common is using malware—like Trojans, spyware, keyloggers, and stealers—which are specifically designed to steal passwords, credit card details, crypto wallet keys, and other sensitive data.

Malware threats usually spread through phishing emails with malicious links or attachments, fake websites, or even disguised as software updates. Once installed, they can scan the system, sift through files and browsers, record keystrokes, take screenshots—and do it all quietly, without the user ever realizing it’s happening.

Another way data—especially business data—gets compromised is when databases or code repositories are left exposed online. Misconfigured cloud storage or weak access controls can leave the door wide open for attackers to swoop in and take whatever they find. Once they’ve obtained the data, the next step is to upload it to the dark web, put a price on it, and wait for the buyers.

What can you do to prevent data exposure?

While everything we’ve covered so far may be overwhelming and spine-chilling, rest assured that you are not without options. There are several habits you can quickly adopt to protect your data from being exposed and sold on the dark web. Here are a few important steps to consider:

Don’t interact with suspicious emails and websites

We’ve all come across fake websites and scam emails at some point—it’s how we respond to them that matters. If something looks fishy, off, or just doesn’t feel right, don’t engage. Don’t click on any links, don’t enter your info, don’t log in with your Google or Facebook account. Just steer clear and avoid any interaction.

Avoid oversharing information online

Putting a spin on a popular saying: “What happens online, stays online.” This means that if you share something in the digital world, it’s highly likely that a trace of it will always remain. So, be mindful of what you share online. You never know how much information attackers might use to try to trick you with their advanced social engineering techniques.

Enable multi-factor authentication (MFA)

Relying on just a password to protect your accounts isn’t enough these days, especially if your passwords aren’t exactly strong. That’s where multi-factor authentication steps in. It adds an extra layer of security by requiring additional proof of identity (like a code sent to your phone) to confirm that it’s really you trying to log in. This means that even if someone gets hold of your password, it’s much harder for them to actually break in and steal your data.

Set up data breach alerts

One of the most important steps in solving a problem is knowing it exists in the first place. If your data has been compromised, the sooner you find out, the better your chances of minimizing the damage. For example, if you learn that your login credentials have been posted on the dark web, you can try to change your passwords before anyone has a chance to use them. Or, if something like your scanned ID card shows up, you can alert the authorities and start the process of getting it replaced. That’s why it’s smart to use the dark web and data breach monitoring tools, like NordPass’ Data Breach Scanner. They automatically scan the web for any signs that your data has been compromised and alert you right away if they detect anything suspicious.

Use a password manager

You really can’t afford to rely on old, weak, or reused passwords to protect your online accounts. What you need is a robust password manager like NordPass to keep things safe. It lets you create strong passwords for all your accounts and store them—along with your passkeys, credit card info, and other sensitive data—in a secure, encrypted vault. Plus, with handy features like autofill and Secure Sharing, you’ll be less likely to accidentally type your credentials into a fake website or send them through unprotected channels. If you want to protect access to your accounts, this is the way to go.

And how can businesses protect themselves?

For businesses, especially enterprises, defending against cyberattacks and preventing data from leaking into the dark web is no small task. But there are a few steps every organization can take to help avoid exposing sensitive company information. Those are:

Educate your employees

Human error is still a major cause of data breaches. So, investing in security training for your team is essential. It helps your employees realize how one small mistake can put the whole company at risk, and shows them how to use defense tools and follow processes so they can work efficiently and make smart cybersecurity choices.

Establish strong access controls

To protect your company from leaks, you need to know what information is shared, who it’s shared with, and why. You also need strict access rules based on the zero-trust principle—no one gets easy access, and everyone has to be authorized to get in. You can use tools like NordPass to keep track of how access is granted, managed, and shared across your teams—and revoke it if things start to go too far. This will help you limit and effectively secure access points to your company’s data.

Always keep your data in a truly safe place

Just like today’s data privacy laws, like HIPAA and GDPR, require your company to handle and store customer data securely, your internal security policies should do the same for all company data. That means making sure your company’s digital resources are stored in a secure environment where only authorized people can access them.

This can be achieved through encrypted cloud servers, a segmented network with monitored access points, and tight control over who can access sensitive information. Not only does this keep your data protected—it also shows clients and partners that they can trust you to keep their data safe and sound.

Bottom line

Some stolen digital goods are available for purchase on the dark web at shockingly low prices, like $5–$25 for a stolen online account password. Depending on the potential impact, prices can increase, especially for items that could give attackers access to a company’s IT infrastructure and databases.

Still, the cost of stolen data on the dark web is minimal compared to the illegal profits attackers can make and the financial damage they can cause to individuals and organizations. That’s why, whether you’re a regular Internet user or a large-scale company, you need to invest in strong cybersecurity tools and be vigilant about your online activities to minimize your digital footprint and prevent data leaks.

 

About NordPass
NordPass is developed by Nord Security, a company leading the global market of cybersecurity products.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

Public Wi-Fi risks that put your business data in danger

Summary: Public Wi-Fi risks include data theft, malware, and email compromise. To stay secure while remote, businesses should combine training, VPNs, and threat protection.

We live in a world where it’s easy to send a quick work email at the airport lounge or finish design tasks in neighborhood coffee shops after hours. Remote work is great in theory. However, if we don’t understand public Wi-Fi risks, working remotely can lead to cybersecurity disasters.

Public Wi-Fi networks are often a network security blind spot. Users sometimes drop their guard, exposing online accounts and security credentials that should remain locked down. That’s why robust public Wi-Fi security is essential for business.

This article addresses Wi-Fi security, exploring critical risks, mitigation strategies, and employee best practices for public Wi-Fi users.

Key takeaways

  • Many public Wi-Fi networks lack adequate security measures such as encryption. “Evil Twin” attacks complicate the issue by creating fake hotspots that appear legitimate. Users must be vigilant and aware to protect their online security.
  • Using free Wi-Fi is extremely risky. Hackers use public Wi-Fi connections to monitor targets, extract credentials, deploy malware, and mount identity theft attacks. They can also spread phishing emails, hijack sessions, and divert users to fake websites.
  • Protect work devices on public Wi-Fi by enforcing VPNs, malware scanning, MFA, and threat intelligence. Unsecured devices should never connect to insecure Wi-Fi networks.
  • Best practices for employees include data encryption, using a VPN and firewall combination, and learning how to verify that they are using a secure network. Employees should avoid sensitive tasks on Wi-Fi networks, especially those involving financial data.

What makes public Wi-Fi networks risky?

Around 60% of us regularly use hotel or airport Wi-Fi to send emails and collaborate with colleagues. Wi-Fi liberates employees to work wherever they are. However, this freedom brings cybersecurity risks. If you exchange sensitive data or files via public networks, data loss is always a possibility.

Why is this? The problem is that many public Wi-Fi networks lack security measures to prevent hijacking and protect users from criminal activity.

Unsecured Wi-Fi networks often lack password protection and authentication or rely on default passwords that attackers can easily guess. They also use unencrypted plain text, allowing data to flow openly from user devices to the internet.

Moreover, companies that fail to secure their Wi-Fi networks are also vulnerable to spoofing (so-called “Evil Twin” attacks).

In Evil Twin attacks, criminals create a fake public Wi-Fi hotspot that resembles the real thing. For instance, they might create an access point called “Airport_StarbucksWiFi.” The fake hotspot looks normal but allows threat actors to distribute malware and hijack connections.

Evil Twin attacks are more likely when businesses outsource Wi-Fi networks to IT partners. Airports regularly outsource connectivity, losing the ability to police internet traffic and crack down on copycat hotspots. Cybercriminals leap into that accountability gap, often without detection.

As a Wi-Fi user, identifying fake nodes or poor security measures is not simple. Most of the time, we want to log on smoothly and quickly without worrying about data security. Unfortunately, that’s a mistake.

Unsafe Wi-Fi exposes everything users do online, and we must remain vigilant.

In one study, researchers monitored 11 unsecured Wi-Fi hotspots around Nara, Japan. Over 150 hours, they gathered unencrypted photos, documents, emails, and credentials. All of the harvested data was in plain text, ready to use for whatever purpose attackers desired.

 

Common dangers of free Wi-Fi networks

Public Wi-Fi networks are dangerous services. However, you can use them safely if you take action to mitigate critical public WiFi risks. Mitigation starts with understanding how attackers use Wi-Fi and how threats operate.

Free Wi-Fi networks, What can go wrong

 

Man-in-the-Middle attacks

The Man-in-the-Middle (MitM) attacks involve attackers placing themselves between user devices and the public internet. Fake public Wi-Fi networks are perfectly adapted for this attack method.

Criminals controlling a public Wi-Fi hotspot use sniffing tools to monitor data and harvest unencrypted credentials from users on the same network. They can mount session hijacking attacks to execute financial transactions or redirect users to malicious websites.

Malware distribution

Unsecured networks enable malware distribution in several ways. For instance, attackers can use compromised Wi-Fi servers to redirect network users to fake websites and deliver malicious downloads.

Attackers can also send phishing emails directly to users or leverage software exploits to implant spyware tools. The bottom line is that using unsecured public Wi-Fi connections offers an open door for malware attacks.

Identity and credential theft

Both MitM attacks and malware can extract user credentials and other confidential information. Attackers use this information to mount secondary attacks. For example, they might use login credentials to apply for loans or gain access to business networks. They can also sell extracted data on dark web marketplaces.

The trouble with identity theft attacks is that they are hard to trace. Victims do not know criminals are using their login credentials until it’s too late. That’s why we recommend that Wi-Fi users regularly request a dark web scan to check for leaked emails and login details.

Business email compromise

In business email compromise attacks, criminals pose as legitimate contacts and persuade victims to transfer money or confidential information.

Unsecured Wi-Fi allows attackers to extract your email address and monitor email contents. Attackers can learn who you are and create persuasive phishing emails to suit their strategy.

Alternatively, hackers could hijack your business email account via compromised Wi-Fi connections. They can assume your corporate identity, using it to email colleagues, clients, and bosses. This technique builds false trust, enabling criminals to arrange payments or steal data without detection.

How much can security incidents cost companies

Using public Wi-Fi without protective measures is risky. But how risky is it from a financial and reputational perspective?

The answer is, very risky. Companies that neglect public Wi-Fi safety run unacceptable risks with potentially drastic consequences. Most significantly, a single insecure Wi-Fi connection can lead to enterprise-wide data breaches.

According to IBM, the average cost of a data breach reached $4.88 million in 2024—a 10 percent increase from the previous year. 66% of consumers lose trust in companies that suffer data breaches, and 75% consider avoiding their products.

Using public Wi-Fi amplifies this critical business risk. Statista reports that 25% of those using cafe Wi-Fi networks reported identity compromise attacks. Another survey found that 18% of Wi-Fi users reported experiencing cybersecurity incidents linked to public networks.

Even worse, 45% of respondents admitted to making financial transactions via public Wi-Fi and 47% failed to verify the legitimacy of Wi-Fi hotspots. So while public Wi-Fi is risky, users often underestimate the hazards and are liable to put data at risk.

Ways to stay safe on public Wi-Fi

Identity theft and data breach attacks are costly, but employees often need flexible internet access—especially when traveling. Companies must balance flexible working practices with robust cybersecurity. That way, businesses can enjoy the benefits of public Wi-Fi and neutralize the negatives.

Let’s start with some security fundamentals to strengthen your security posture and protect users wherever they access the internet.

How to stay safe on public Wi-Fi
  • Use a Virtual Private Network (VPN)—VPNs encrypt connections and assign anonymous IP addresses to user devices. With a Business VPN installed, employees access network assets via a secure connection. Even snoopers in control of Wi-Fi nodes can’t easily decrypt web traffic. Integrate VPN usage into your remote work policies. Require employees to use an approved business VPN on all work devices.
  • Scan downloads for malicious content—Criminals use unprotected Wi-Fi networks to divert users to fake websites and seed malicious downloads. Guard against this risk with Malware Protection tools that scan incoming files and identify malicious software.
  • Implement real-time malware protection—It’s also wise to use continuous threat scanning tools. Malware can infect any device via drive-by downloads or email attachments. Real-time malware scanning detects these threats before they steal data or damage assets.
  • Leverage advanced threat intelligence—Threat intelligence provides up-to-date knowledge about active threat actors and attack techniques. Advanced knowledge makes it easier to mitigate risks and apply suitable Wi-Fi security measures.
  • Secure all user accounts with multi-factor authentication (MFA)—Attackers may obtain user IDs or passwords via packet sniffing or malware. However, if you use MFA for network logins, criminals won’t be able to access critical assets easily.

 

Best practices for employees using public Wi-Fi

The recommendations above will help you manage public Wi-Fi risks, but they aren’t the end of the story. Wi-Fi security is fundamentally about safe user behavior and training. Security-aware employees are far less likely to fall for Evil Twin attacks or phishing scams.

With that in mind, here are some best practices that employees should follow when connecting to public Wi-Fi networks:

 

Learn how to recognize fake Wi-Fi networks

Training should focus on educating employees to understand public Wi-Fi security risks and identify fake networks. Educate staff to be alert to the risk of using free Wi-Fi networks, and require users to verify the hotspot with the staff at hotels or coffee shops before connecting.

 

Turn off auto-connect settings

Device users often enable auto-connect at home and forget that it applies elsewhere. However, devices may automatically connect with unsafe networks. Disable this feature and require manual logins for each public Wi-Fi internet connection.

 

Encrypt sensitive information on devices

If users regularly work remotely, require the encryption of sensitive data in specific folders. Ban the storage of work documents in plain text files, and consider requiring end-to-end email encryption for work-related file transfers.

Enable VPNs and firewall protection

As noted earlier, business VPNs bring public Wi-Fi users within your security perimeter. Combine robust VPN encryption with approved device firewalls to block most threats before they compromise data.

 

Don’t use public Wi-Fi for sensitive activities

Attackers can’t steal financial credentials if you don’t type them into browsers. Tell staff to avoid sending payments via public Wi-Fi or discussing financial matters via insecure connections. The same applies to collaborating on confidential projects. If privacy is critical, use cellular hotspots or reliable Wi-Fi connections.

Require regular updates

Patch management manages the risks related to outdated operating systems and internet-facing applications. Remember: attackers look for WiFi security exploits to access devices and business networks. Make sure every critical app is up-to-date and protected against known vulnerabilities.

 

How NordLayer can help

Avoiding public Wi-Fi risks is not just about training. NordLayer’s security platform reinforces employee knowledge by providing the tools to safeguard data and counter cyber threats.

For example, our Business VPN applies encryption and IP address anonymization to all users when they connect to the company network. Encryption locks down the content in transit of user devices, while the Always-On VPN feature ensures complete coverage. Your internal network remains invisible to attackers; sensitive data is always off-limits.

Our Download Protection tools screen downloads for malware threats. If Man-in-the-Middle attacks divert users to fake download sites, our tools detect threats before they execute malicious code. Real-time malware protection operates in the background, ensuring a seamless user experience.

NordLayer also leverages global threat intelligence to counter emerging threats and criminal actors. Our threat intelligence solution detects attacks early based on signatures and unusual behavior. Security teams enjoy network-wide visibility via real-time internet traffic monitoring.

Companies that allow employees to use unsecured public Wi-Fi networks should expect internet security issues sooner rather than later. However, NordLayer will help you strike a strategic balance between flexible work and cybersecurity. Contact our team to reduce public Wi-Fi risks without compromising employee performance.

Frequently asked questions

What information can hackers steal while browsing on public networks?

Hackers can steal any data passing across an unsecured Wi-Fi network connection. This includes email contents and metadata, search queries, file transfers, and login credentials for network portals, social media accounts, or financial services.

Stealing data stored on user devices is harder but also possible. Attackers can deploy malware to extract files from hard drives or connected devices. In short, any information on your device is at risk when you use unsecured free WiFi connections.

What are the biggest risks when using public WiFi networks?

Public WiFi use carries many cybersecurity risks. The biggest risk is the extraction of login credentials and other sensitive information. Attackers can sniff credentials from active connections and use this information to access network resources.

Public Wi-Fi users also risk malware infections from fake websites or direct deployment. Attackers can distribute phishing emails or pop-up alerts to users on the same network. They can also use session hijacking techniques to control applications and compromise network security.

How does the use of a VPN help you stay protected?

Virtual private networks protect public Wi-Fi use by encrypting data and assigning anonymous IP addresses. Encryption conceals the data you send over free wifi connections. Attackers cannot see what you type or the emails you send and tend to shift focus to easier targets instead.

 

About NordLayer
NordLayer is an adaptive network access security solution for modern businesses – from the world’s most trusted cybersecurity brand, Nord Security.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

What is the Principle of Least Privilege (PoLP)?

How does the principle of least privilege work?

Technically speaking, the principle of least privilege—often called the minimum privilege principle—is rooted in the Zero Trust security philosophy. Access is restricted not only to specific resources and data but also to application functions, so users see only the features they need.

  1. Identify essential job functions and map out the precise permissions required for each role.

  2. Allocate minimal privileges to users, granting access only to the data, systems, and application features critical for their tasks.

  3. Monitor and adjust privileges over time, especially as roles evolve or employees join and leave.

By integrating PoLP with Zero Trust Network Access (ZTNA) 2.0, organizations can dynamically verify every access request, reducing the risk of privilege misuse and lateral movement by threat actors.

Why is the principle of least privilege important?

Let’s look at a hypothetical situation. Say an HR employee has access to the human resources management system to update employee records. But if they also have access rights to access the IT infrastructure, which are not essential for their HR-related tasks, the risk of a full-blown data breach increases significantly in the event their account is compromised.

The hypothetical above showcases the principle of least privilege benefits, which include:

  • Reduce the potential attack surface: Limiting user access privileges means fewer opportunities for bad actors to exploit those privileges.

  • Minimize the impact of exploits: Even if a hacker can gain unauthorized access to the user’s account, the security principle of least privilege confines the possible damage.

  • Come closer to adhering to regulatory frameworks such as GDPR and HIPAA: Regulatory frameworks such as GDPR and HIPAA require strict access controls. By applying PoLP and ensuring users have access only to the information and systems essential for their tasks, an organization can get closer to being compliant with various regulations.

  • Improve security within the hybrid work environment: In a hybrid work environment, where employees access systems remotely, maintaining strict access controls becomes even more important. Implementing the principle of least privilege ensures that the security risks associated with remote access are reduced significantly.

Zero Trust vs Least Privilege

In modern digital security, Zero Trust and the principle of least privilege in cybersecurity are the two sides of the same coin. Zero Trust demands that every access attempt be continuously monitored and verified, while PoLP ensures that, once granted, access remains narrow and appropriate.

Zero Trust is a cybersecurity concept built on another simple idea: never trust, always verify. Unlike the traditional security frameworks, Zero Trust Security assumes that threats can come from within as well as outside the network.

At its core, Zero Trust embodies the principle of least privilege by enforcing strict access controls and permissions. Every access or connection request, regardless of origin, is treated as untrusted until verified otherwise. This stringent verification process is an extension of PoLP’s main idea — to provide users with only the necessary access levels.

In practice, Zero Trust treats every access request as if it’s the first request coming from an untrusted network. Each request is always re-authenticated regardless of previous requests or connections. In this sense, you can think of Zero Trust as a dynamic framework while PoLP can be considered static because it provides users with specific access rights that remain the same unless adjusted.

To make the distinction between Zero Trust and PoLP clearer, let’s imagine a high-end office building. In this case, Zero Trust would be the foundation of the building’s security system, which requires employees, regardless of their position, to use an access card to enter the office building and other facilities. The principle of least privilege, in this scenario, could be likened to the specific programming of access cards based on the employee’s role: for instance, providing the IT staff with access to server rooms, while not granting the same privileges to, say, the marketing team.

 

What is Privilege Creep?

Privilege creep is a term that refers to a user who gradually accumulates more access rights than are required to execute their function. Privilege creeps most often comes into being due to role changes that do not trigger an adjustment concerning access privileges. When thinking about organizational cybersecurity, privilege creeps pose a serious risk where unauthorized access to a single account could lead to an enterprise-wide data breach.

Here are best practices when it comes to the principle of least privilege, helping to prevent privilege creeps from materializing:

  • Implement role-based access controls: Clearly define roles and associated permissions to make sure access rights are granted based on the necessities of the job.

  • Conduct regular access reviews: Schedule periodic reviews of user privileges to identify and rectify any discrepancies or excessive access rights.

  • Enforce a Zero-Trust security approach: Adopt a zero-trust policy where no user is trusted by default. Verify every access request, regardless of the user’s position within the organization.

  • Make use of automated tools: Leverage automation for managing access rights. Tools like Privileged Access Management (PAM) systems can help in monitoring and controlling access rights efficiently.

  • Promote security awareness: Educate employees about the risks of privilege creep and the importance of adhering to cyber security protocols.

By proactively managing user permissions and educating employees, you can significantly mitigate the risk of privilege creep and enhance your organization’s overall security posture.

How to Implement the Least Privilege Principle in Your Organization

Adopting the principle of least privilege in your organization can be a lengthy process; however, the juice is well worth the squeeze. Once your organization operates under PoLP, the potential attack surface will shrink significantly. Here are a few best practices when it comes to the implementation of PoLP:

  • Define access requirements clearly: Before adopting the principle of least privileges in your organization, you need to have a clear understanding of the data access needs of various roles within the organization.

  • Implement Role-based access control (RBAC): Once you have a clear understanding of access requirements, setting up RBAC will be a lot easier. You’ll need to create roles based on job functions and assign permissions to these roles rather than for individual users.

  • Utilize Just-In-Time (JIT) privilege access: Enhance security by granting time-limited privileges on a need-to-use basis. Establishing JIT access privileges will restrict the window of opportunity for access to sensitive data, minimizing the risk of insider threats or external breaches that would exploit user access privileges.

  • Enforce Multi-factor authentication (MFA) and password policies: Strengthen the authentication processes by establishing MFA as an additional layer of security next to company-wide password policies. MFA ensures that even if the password of a critical account is compromised, the attackers will not have a chance to access it as they will not have another authentication factor required.

  • Implement system monitoring: Establish surveillance of system and user activities to quickly identify and respond to abnormal access patterns or potential security incidents.

How can NordPass help?

These days, when access points seem to multiply as fast as potential security threats, adopting the principle of least privilege within a business setting should be a no-brainer. PoLP implementation can reduce, quite significantly, the organization’s attack surface and generally improve overall cybersecurity. There’s also the added benefit of coming closer to compliance with various regulatory frameworks such as HIPAA or GDPR.

While the adoption of PoLP can be challenging, there are tools that can make this a lot easier and NordPass Enterprise is one of them. It’s an enterprise-grade password manager that’s built on the principle of the Zero-Knowledge architecture and is equipped with the XChaCha20 encryption algorithm.

But that’s just the tip of the iceberg. NordPass’s integration with Single Sign-On (SSO) is a key asset in adopting PoLP. By allowing users to use a single set of credentials to access multiple resources, SSO simplifies authentication and enhances security. NordPass Enterprise is compatible with major identity providers such as Microsoft Azure AD, MS ADFS, and Okta. This centralized management system is effective in preventing unauthorized access and minimizing potential security breaches by assigning user access based on specific roles.

NordPass also helps organizations in managing user access effectively. It allows administrators to assign, revoke, or modify user access to login credentials, personal information, payment card data, and other sensitive data according to specific needs. This flexibility, powered by the Activity log feature, is critical when adopting PoLP. For teams looking to streamline this process and enforce access control across departments, NordPass Teams offers practical, scalable solutions. It’s particularly useful for IT managers and decision makers aiming to balance ease of use with advanced security protocols. Thanks to this functionality, organizations can easily adjust access rights in response to changes in roles or employment status.

Learn more about how NordPass Enterprise can benefit your organization’s overall security strategy by visiting the official NordPass Enterprise website.

About NordPass
NordPass is developed by Nord Security, a company leading the global market of cybersecurity products.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

Need help? Our team is just a message away