Why your password manager needs hardening after 624 million passwords stolen

Research published in March 2026 found that infostealer malware harvested roughly 624 million passwords in 2025, a figure more than 18 times higher than those lifted from classic compromised databases, according to tech-insider.org. The vault on your laptop is now a bigger target than the individual websites you log into. When attackers compromise that vault, they can expose your entire business data in one move. Hardening your password manager is no longer optional if you want to protect your office from modern credential theft.

The threat landscape shifted dramatically in the first half of 2025. Flashpoint recorded an 800% jump in infostealer-driven credential theft, pulling roughly 1.8 billion credentials from about 5.8 million infected devices. That’s a massive increase from the prior four months. Your front-desk PC or the contractor’s tablet is now a direct gateway to your office records.

Why does this matter to you? Credential stuffing accounted for 22% of all data breaches across 2024 and 2025, overtaking classic phishing as the most common breach vector, according to DeepStrike. Attackers test stolen credentials against banking, email, and retail logins in bulk. If you use the same password for your office email as you do for a personal account, one leak compromises both.

SpyCloud found around 1.1 million master passwords for password managers sitting in leaked datasets. When that happens, the entire vault is compromised in one move. It’s not just about weak passwords anymore. It’s about how your vault behaves when the device itself is infected.

How to harden your password manager

You don’t need to switch apps to fix this. Whether you run Bitwarden, 1Password, or KeePassXC, these steps apply with minor menu differences. Here’s what to do this week.

• Run your password manager’s built-in vault health or watchtower report to check for reused or breached passwords.
• Rebuild your master password to be a passphrase of at least five random, unrelated words, around 20 to 30 characters total, according to National Institute of Standards and Technology guidelines.
• Add a FIDO2 hardware security key to your vault unlock screen to provide a second factor that can’t be phished.

Register a second, backup hardware key and store it in a secure location separate from your main desk or bag.

If you haven’t checked your exposure recently, use Have I Been Pwned’s Pwned Passwords feature to see if your passwords appear in known breach databases. It works on a k-anonymity model so your actual password is never transmitted. A few minutes now saves a lot of headaches later.

Sources: tech-insider.org.