how it happened
- whobotsreused password lists
- the gapNorton accounts~925,000 targeted
- the resultthousands enteredpassword vaults at risk
what everyone assumed
A password manager is the tool you trust precisely so you can stop reusing credentials, and many people set one up to fix exactly that habit. The quiet assumption is that the manager’s own login is somehow a different category of account, more protected than the ones it protects. It is the same kind of login, checked by the same kind of form.
what happened
The attempts ran as a credential-stuffing campaign through early December, lists of reused username-and-password pairs replayed against Norton accounts by bots. Norton’s intrusion-detection systems flagged the unusual volume on December 12, and the internal investigation closed around December 22. By the company’s account, roughly 925,000 active and inactive accounts had been targeted in the wave.
step by step
- bots replay reused passwords against Norton accountsThrough early December 2022.
- 12 December 2022unusual volume is flaggedAbout 925,000 accounts targeted.
- several thousand accounts are enteredTheir owners had reused passwords.the assumption breaks here
- password vaults may be exposedThe reused password could have unlocked every stored one.
how it surfaced
When Norton notified customers, it reached the subset whose accounts had actually been entered, on the order of several thousand. For those who used Norton Password Manager, the notice carried a particular line: the attacker might have obtained the details stored in the private vault. The account that reused a password may have handed over every password it was keeping.
The vault is only as private as the single credential that opens it, and reusing that one credential quietly cancels the benefit of every unique password inside.
picture it at a company like yours
The company here is made up. The other two paths are not: they happened, and each links to the story.
- in this storythe day it mattersBots try leaked passwords against the password manager and one works.what it costs youEvery password that person stored is now in someone else's hands.
- or it goes like thisit happened23andMe, 2023howLeaked passwords are tried against customer accounts until some open.what leavespersonal details of customers and their contactswho ends up with itfraudsters
- or it goes like thisit happenedThe Snowflake wave, 2024howAn old password opens a data store that never required a second step.what leavesthe whole database in one downloadwho ends up with itan extortion group
sources
your turn
what you can do about it
this week
Check which of your credential stores can be opened with a password alone, and whether the person who set it up reused that password anywhere else.
Somewhere in your company there is a secrets manager, a password vault, or an admin console that holds the keys to many other systems. The assumption to retire is that this account inherits stronger protection simply because of what it guards. The most valuable account in the building is often protected exactly like the least.
go deeper
if you're not sure where to start
Run the offboarding checklist on one leaver. It covers every account and token to close when someone leaves.
open the checklist →