How passwords are stolen and what to check if it happens

Whoever obtains a password can try to log in as its owner to email, FTP, an application or the hosting panel. The source is not always on the server: it is worth reviewing how that credential was used and where it was stored.

Phishing: a page that imitates the service

A message may warn of a suspension, an invoice or a fee and lead to a fake form. Entering your password there can hand it to the attacker, even if a convincing confirmation appears afterwards.

Go to the service's usual address and check the warning from your account. Check the full domain in the browser: a familiar logo or HTTPS does not prove that it belongs to the company. Do not share temporary codes or approve login requests you did not start.

Password reuse

A leak from another service can provide combinations that are then tried on your other accounts. Use a long, unique password for each service, stored in a protected password manager.

If a reused password is exposed, change it everywhere it was used. Adding a number to the old password is not enough. An address found in a leak does not prove on its own that the current password is exposed, but it helps identify which service you should review.

Compromised devices and applications

Malware, malicious extensions or unmaintained software can access saved credentials, capture what you type or use open sessions. Keep the operating system, browser and applications up to date and review the extensions and programs installed.

Use the device's protection mechanisms and a maintained security tool. A scan with no detections does not prove on its own that there was never a compromise. Use a trusted device to change affected passwords.

Connections and stored secrets

Use HTTPS and the encrypted email and transfer protocols. Avoid putting credentials in public files, repositories, tickets, screenshots or commands that stay in the history. Also protect your password manager's backups and its sync account.

Encryption protects data in transit, but it does not stop a compromised device from reading data before it is encrypted. Two-factor authentication reduces login risks; it does not automatically fix an already stolen session or protect every protocol of a service.

If you suspect exposure

Identify the affected account and credential, change that password and any related reuse, review sessions and rules, and remove access by others. Then check that no unknown activity reappears.

Continue with what to do about a suspicious login alert. If the mailbox is blocked, follow the step-by-step email recovery, including reviewing pending messages before allowing sending.