Reusing Passwords: How One Old Login Exposes the Whole Firm
The attacker doesn’t need to break in. The keys might have already been leaked.
An adversary trying to get into your firm's email or website rarely tries to crack the password. That's slow, noisy, and usually pointless.
They look it up instead.
Somewhere in the last fifteen years, a partner at your firm signed up for something — a conference portal, a CLE provider, a hotel loyalty program, a forum — using the firm email address and a password. That service was breached at some point. The password went into a database that has been circulating ever since. If that partner used any version of the same password for their firm login, then the firm's password isn't secret. It's archived.
The attacker doesn't need to break in. They need you to have reused a password.
Where leaked credentials actually live
Every service you sign up for stores your details in a database — email addresses, and depending on how carelessly the service was built, passwords too. When an adversary finds a weakness in one of those services and reaches the database, that data gets harvested and then sold or dumped publicly, in what's known as a data breach.1
The crucial reframe: your email address isn't just a mailbox. It's a username. It's the identifier that ties together every account you've ever opened. That's precisely why it's the anchor an investigator — or an attacker — builds from.
How trivially easy this is to check
The free service Have I Been Pwned will tell anyone, in seconds, how many known breaches a given email address appears in.
It goes further than one address at a time. Tools like IntelligenceX let someone search by company domain — pulling from breaches, leaks, paste sites, and dark web sources — to answer the question "which people at this organization have credentials floating around?"2
So put yourself on the other side of it. An adversary looking at your firm doesn't start with your firewall. They start by asking which of your people already have an exposed password sitting in a public dump — and then they try it against your webmail, your document management system, and your website's admin login.
Credential stuffing, defined
The technique has a name: credential stuffing. Take a list of leaked email-and-password pairs, and replay them automatically against a lot of different services, betting that some percentage of people reused the pair. It's automated, it's cheap, and it works often enough to be an entire criminal business model.
It's also the reason password reuse is uniquely dangerous. Every other bad password habit — one weak password, one password on a sticky note — hurts you once. Reuse turns a single unrelated breach, years ago, at a company you've forgotten about, into a live key to your firm.
In the United States
Formal Opinion 477R addressed securing client information in electronic communication, and the measures it discusses as routinely accessible include the unremarkable ones: unique complex passwords, changed periodically; multifactor-protected access; secure connections.3 These aren't exotic asks. They're the baseline the Committee treated as ordinarily available to any lawyer.
The reasonableness standard under Rule 1.6(c) is fact-specific — it asks whether you have a process for assessing risk and applying measures responsive to it, not whether you bought a particular product.4 A firm where three people share one password across nine systems does not have a process.
In Canada
The competence commentary asks lawyers to understand the risks associated with the technology they use, tied expressly to the confidentiality duty.5 Password reuse is a risk of the technology you already use, and understanding it costs nothing.
What actually fixes this
1. A password manager. This is the whole ballgame. Not "pick better passwords" — humans cannot generate and remember 60 unique strong passwords, and asking them to is how you get Firmname2024! on everything. A manager generates a different random password for every service, and the human remembers exactly one. Every other recommendation here is a distant second to this one.
2. Multi-Factor Authentication (MFA) on everything that matters. Email first, then the site admin, then the document system. MFA is what makes a stolen password insufficient on its own — it's the control that specifically defeats credential stuffing.
3. Find out what's already out there. Run a domain-level exposure check to see which of your firm's addresses appear in known breaches. This is a five-minute exercise that tells you where you actually stand. Any address that shows up: change that password everywhere it was ever used, not just at the breached service.
4. Re-check periodically. Breaches surface years after the fact. A clean result today isn't durable — it's a snapshot.
5. Kill the shared logins. The "everyone uses the office password" account is the one that never gets rotated when someone leaves.
How we can help
We'll run the domain exposure check for your firm and tell you plainly which of your addresses are already sitting in public breach data. On the site side, we handle the part that's ours: MFA on the admin layer, killing shared and default accounts, and rate-limiting the login page so stuffing attempts fail quietly instead of succeeding quietly.
We'll tell you what's already public about your firm's logins. This reports exposure, not passwords — we don't retrieve or handle credentials.
Your firm's credential checklist
Footnotes
- Rae Baker, Deep Dive: Exploring the Real-World Value of Open Source Intelligence 125 (Wiley 2023). ↩
- Id. at 127. ↩
- ABA Comm. on Ethics & Pro. Resp., Formal Op. 477R (2017). ↩
- Model Rules of Pro. Conduct r. 1.6(c) (Am. Bar Ass'n 2023); ABA Comm. on Ethics & Pro. Resp., Formal Op. 483 (2018). ↩
- Model Code of Pro. Conduct r. 3.1-2 cmts. [4A]–[4B], r. 3.3-1 (Fed'n of L. Soc'ys of Can. 2019). ↩
Trusted by professionals like you.
