There is a market for stolen business logins. Stay off it.

Published 2026-06-19 by Woodruff Training

Here is an uncomfortable fact. When criminals break into a business, they often do not use the access themselves. They sell it. There is a working market where one group steals logins and another buys them to launch a scam or a ransomware attack. And small businesses are the bulk of the stock. In one 2026 analysis by Kaspersky, more than half of these "access for sale" listings concerned small and medium organisations.

The reassuring part is that you do not need to be a security expert to stay off that list. You need a few habits that make your accounts more trouble than they are worth.

How your login ends up for sale

Usually it is nothing dramatic. A staff member reuses the same password across several sites. One of those sites is breached, the password leaks, and criminals quietly try it everywhere else, including your email and your accounting. Or someone types their details into a convincing fake login page. Either way, a working username and password is now worth money to somebody.

The habits that keep you off the list

  • Turn on multi-factor authentication everywhere it is offered. Even if a password leaks, it is not enough on its own. This is the big one, and we wrote a separate note on it.
  • Use a password manager so every account has its own long, unique password. Then a leak from one site cannot unlock the others.
  • Close accounts for people who have left, and old logins nobody uses. Every unused account is a door left unlocked.
  • Watch for sign-ins from odd places or at odd hours, and act on the alerts your systems send you.

Find out if you are already exposed

Some of your passwords may already be out there from past breaches, and it is worth knowing which. A quick check of your business email addresses against known leaks shows you where to focus first. We run exactly that as a domain and email exposure check, and it is often a sobering but genuinely useful place to start.

Stay off the list, and most of these attacks never get going. Get in touch if you would like a hand.