Let’s start with a simple thought experiment.
What if someone could log into your systems today using a password one of your employees created years ago – and completely forgot about?
Not their current password.
Not something they’d recognise.
Just an old login that was never properly shut down.
That scenario isn’t hypothetical. It’s exactly how a recent data‑theft campaign played out across dozens of businesses worldwide.
The common weak point
In a large‑scale investigation, cyber security researchers uncovered a campaign where attackers quietly gathered sensitive business data and later sold it online.
The affected organisations varied widely – different sectors, different countries, different sizes.
But they all shared one critical weakness.
Access to key cloud systems was protected by passwords alone.
No second step.
No approval request.
No additional check to confirm the person logging in was legitimate.
That single decision made the attackers’ job much easier.
How the passwords were stolen
The attackers didn’t need to guess passwords or break in through brute force.
Instead, they relied on info-stealing malware – malicious software that can sit on a device without the user realising it’s there.
Once installed, it quietly collects saved login details and sends them back to criminals.
This can happen on:
- Home computers
- Personal laptops
- Shared devices
- Any machine that’s ever been used to sign into work systems
And here’s the part many businesses miss:
Those stolen credentials don’t always get used straight away.
Old passwords, new problems
In this campaign, some of the passwords being used were years old.
That tells us two important things:
- Old credentials were still valid long after they should have been retired
- Past mistakes were still creating risk in the present
Security professionals sometimes call this a latency problem. The threat doesn’t disappear just because time has passed. It waits quietly until the opportunity arises.
And when it does, the damage can happen quickly – often without triggering immediate alarms.
One control would have stopped the attack
In every one of these cases, the attackers had the passwords.
What they didn’t have was the second factor.
No phone.
No authentication app.
No approval prompt.
If multi‑factor authentication (MFA) had been enforced, those stolen passwords would have been useless.
That’s why MFA is now considered one of the most effective, and simplest, security controls available.
Why MFA still gets resisted
The most common objection to MFA is inconvenience.
Yes, it adds an extra step to logging in.
Yes, it takes a few seconds longer.
But compare that minor friction to the alternative:
- Confidential files accessed without permission
- Data copied and sold without anyone noticing
- A breach caused by a password nobody even remembers
MFA changes the balance of risk. It turns a stolen password from a serious problem into a dead end.
Passwords alone aren’t enough anymore
This isn’t about being overly cautious. It’s about recognising how modern attacks actually work.
Passwords get reused.
Devices get infected.
Credentials leak over time.
Relying on passwords alone is no longer reasonable – especially for cloud services that can be accessed from anywhere.
That’s why enforcing MFA is now a baseline expectation, not an advanced security feature.
If you want to understand how MFA fits into a broader, sensible security strategy, you can learn more on our cyber security services page.
One extra lock makes all the difference
Old passwords don’t expire on their own.
Risk doesn’t fade just because nothing has gone wrong yet.
Enforcing MFA is one of the simplest ways to reduce your exposure to modern attacks – without slowing your team down or blocking productivity.
If you need help enforcing MFA properly, reviewing your current setup, or improving your overall cyber security posture, get in touch. We’ll talk you through it in plain English.
