Your password is probably out there. Make it not matter.
A record set of exposed logins makes one thing clear: passwords alone cannot protect a business. Passkeys and strong MFA can.
By the Xuru Technologies team · 2 July 2026
Key takeaways
- Researchers reported about 24 billion exposed credentials across online services on 17 June 2026.
- June also saw attackers exploit zero-days in VPN appliances and Oracle PeopleSoft.
- Phishing-resistant MFA and passkeys stop most account takeovers that use stolen passwords.
Most breaches start with a login. When billions of usernames and passwords circulate, attackers simply try them until one works.
What happened
CM-Alliance's June round-up listed the credential exposure alongside ransomware attacks on manufacturers and data theft at Kodak, a law firm and a university. Comparitech tracked ransomware activity across the first half of 2026.
What it means for businesses
- Reused passwords are open doors. One leak unlocks many accounts.
- Website admins are targets. CMS logins give attackers control of your public face.
- Email is the master key. Password resets flow through it.
Login security checklist
| Control | Priority |
|---|---|
| Passkeys or security keys for email and admin | Highest. |
| Password manager for all staff | High. |
| Login attempt limits on your website | High. |
| Remove former staff accounts | Monthly. |
| Recovery contacts and backup codes stored safely | Before you need them. |
Frequently asked questions
How many credentials were exposed in June 2026?Researchers reported about 24 billion exposed credentials across online services, according to June 2026 security round-ups.
Researchers reported about 24 billion exposed credentials across online services, according to June 2026 security round-ups.
What is a passkey?A login method that uses your device to prove who you are, instead of a password, and resists phishing.
A login method that uses your device to prove who you are, instead of a password, and resists phishing.
How do I check if my business accounts are exposed?Use breach notification services for your domain, reset any reused passwords and enable MFA everywhere.
Use breach notification services for your domain, reset any reused passwords and enable MFA everywhere.
Make stolen passwords useless.
Login hardening, passkeys, MFA and lockout protection for websites and business accounts.
Websites, payments, digital marketing, AI automation, consultancy and practical technology training — for businesses and aspiring professionals worldwide.
Saturday – Sunday: closed
Leave a Reply