A staggering 18% of observed bot traffic is tied to credential stuffing, and that is directly fueled by password reuse patterns that keep resurfacing across breached credentials. Even when organizations notice compromise, password reset delays average 3.2 days, extending the window for account takeover and turning a single reused password into widespread damage.
Key Takeaways
- 2019: Average cost per compromised record in breaches involving credentials was $150, reflecting downstream account takeover due to reuse
- 2023: $1.98 million was the average cost of breaches involving stolen credentials (category-specific average)
- 2021: Identity-related incidents cost organizations an average of $15.5 million annually in large enterprises (including account takeover impacts)
- 2020: 80% of breaches involved human error, where credential compromise and password reuse are recurring contributors
- 2018: 45% of people used the same password across multiple sites at least sometimes
- 2021: 49% of users reused passwords across multiple websites, per analysis of large-scale credential leak patterns
- The leaked-password reuse rate across multiple datasets averaged 40% in a 2021 academic analysis of credential leaks (unique password adoption remained low across sites), per the paper’s empirical results
- 2016: Using password managers reduced password reuse by 40% in an intervention study (measured as unique password adoption)
- 2018: Rate limiting and bot detection blocked 88% of credential-stuffing attempts in a production deployment study
- 2022: 91% of organizations reported they use blocklists or allowlists for known bad credential sources, reducing password reuse attack success
- 2021: 479 million account records with credentials were reported in a major breach corpus used in password security analyses
- 76% of organizations reported they have experienced account takeovers in the last 12 months, according to the 2023 “Fraud & Security” survey by FICO (identity-related fraud impacts)
- Credential stuffing ranks among the top 5 web bot attack categories in 2024, with “credential stuffing” showing a measured share of 18% in observed bot traffic, per Distil Networks’ 2024 bot report
- 76% of enterprises reported using risk-based authentication to detect suspicious sign-ins in 2024, per the 2024 “Digital Trust” survey by Thales
Password reuse fuels costly breaches, and stronger controls like password managers and monitoring cut account takeovers.
Related reading
01 · Category
Cost Analysis10 stats
01
2019: Average cost per compromised record in breaches involving credentials was $150,reflecting downstream account takeover due to reuse
02
2023: $1.98 million was the average cost of breaches involving stolen credentials (category-specific average)
03
2021: Identity-related incidents cost organizations an average of $15.5 million annually in large enterprises (including account takeover impacts)
04
2022: 30% of organizations said identity and access issues caused “major business disruption,” often amplified by password reuse
05
Account takeover fraud using stolen credentials rose to 30% of fraud cases in 2023, according to the 2024 Identity Fraud Report by ThreatMetrix (Entrust)
06
$5.0M average cost of account takeover incidents in 2023 was reported in a global risk survey published by TransUnion (includes credential compromise/reuse enabling account access)
07
Credential-stuffing-linked account takeovers resulted in an average loss of $48per event in a 2023 merchant cohort analyzed by Chargebacks911 (public summary)
08
In a 2022 study of security investments, organizations reported that reducing credential reuse improved security outcomes with an average ROI of 4.5x for identity protection tools, per a published case study compilation by SailPoint
09
12% of organizations said they increased IT security spending specifically due to credential-related breach events in 2023, per the 2024 “IT Security Spending” report by Spiceworks Ziff Davis (public findings page)
10
Average annual cost of IAM operational overhead (including password resets and account recovery triggered by reuse) was $2.1 million per enterprise in 2023, according to the 2023 “IAM Costs” report by ForgeRock (public resource page)
Interpretation
Cost Analysis Interpretation
Across cost analysis data, password reuse and stolen credentials keep driving large financial impact, from a 2019 average of $150 per compromised record to $1.98 million average breach cost in 2023 and $5.0 million average account takeover cost the same year, reinforcing that reducing reuse has clear monetary value.
02 · Category
Breach Impact1 stats
01
2020: 80% of breaches involved human error, where credential compromise and password reuse are recurring contributors
Interpretation
Breach Impact Interpretation
In 2020, 80% of breaches involved human error, showing that breach impact is largely driven by credential compromise and recurring password reuse.
03 · Category
User Behavior8 stats
01
2018: 45% of people used the same password across multiple sites at least sometimes
02
2021: 49% of users reused passwords across multiple websites, per analysis of large-scale credential leak patterns
03
The leaked-password reuse rate across multiple datasets averaged 40% in a 2021 academic analysis of credential leaks (unique password adoption remained low across sites), per the paper’s empirical results
04
Users typically created passwords that were shared among 10+ accounts with the same password in 31% of examined password clusters in a 2020 paper on password reuse distribution
05
In a behavioral experiment, 74% of participants reported they reused passwords because it was easier than creating distinct passwords, according to a 2019 peer-reviewed study on password decision-making
06
In a 2022 survey study, 52% of participants changed at least one password only after a compromise announcement, indicating reactive behavior that sustains reuse patterns
07
In a usability study, participants who did not use password managers selected the same password for multiple sites 41% of the time when tasks were repeated after 4 weeks
08
Password reset delays averaged 3.2 days in a 2022 enterprise study, prolonging exposure from reused credentials even after a compromise is discovered
Interpretation
User Behavior Interpretation
From a user behavior perspective, password reuse remains common and persistent, with rates around 40% to 49% across studies and even 74% of people reporting they reuse because it is easier, while reactions like changing passwords after compromise still lag with an average reset delay of 3.2 days.
04 · Category
Mitigation & Metrics3 stats
01
2016: Using password managers reduced password reuse by 40% in an intervention study (measured as unique password adoption)
02
2018: Rate limiting and bot detection blocked 88% of credential-stuffing attempts in a production deployment study
03
2022: 91% of organizations reported they use blocklists or allowlists for known bad credential sources, reducing password reuse attack success
Interpretation
Mitigation & Metrics Interpretation
In Mitigation & Metrics efforts, the trend is clear that layered defenses and healthier password practices measurably cut reuse and attacks, with password managers lowering password reuse by 40% in 2016, production rate limiting and bot detection blocking 88% of credential-stuffing in 2018, and by 2022 91% of organizations using blocklists or allowlists to reduce the success of known bad source attacks.
More related reading
05 · Category
Threat Landscape1 stats
01
2021: 479 million account records with credentials were reported in a major breach corpus used in password security analyses
Interpretation
Threat Landscape Interpretation
In the 2021 threat landscape, 479 million account records with credentials surfaced in a major breach corpus, highlighting just how widespread password reuse risk can be.
06 · Category
User Adoption1 stats
01
76% of organizations reported they have experienced account takeovers in the last 12 months, according to the 2023 “Fraud & Security” survey by FICO (identity-related fraud impacts)
Interpretation
User Adoption Interpretation
From a user adoption perspective, the fact that 76% of organizations reported account takeovers in the past 12 months suggests that many users are still reusing passwords in ways attackers can exploit.
07 · Category
Attack Prevalence1 stats
01
Credential stuffing ranks among the top 5 web bot attack categories in 2024, with “credential stuffing” showing a measured share of 18% in observed bot traffic, per Distil Networks’ 2024 bot report
Interpretation
Attack Prevalence Interpretation
For the Attack Prevalence category, credential stuffing is clearly a major threat with an 18% share of observed bot traffic in 2024, placing it among the top five web bot attack categories.
08 · Category
Detection & Mitigation1 stats
01
76% of enterprises reported using risk-based authentication to detect suspicious sign-ins in 2024, per the 2024 “Digital Trust” survey by Thales
Interpretation
Detection & Mitigation Interpretation
In the detection and mitigation category, 76% of enterprises reported using risk-based authentication to spot suspicious sign-ins in 2024, showing that stronger, adaptive monitoring is becoming a standard defense against password reuse-related threats.
Reference
Cite This Report
This report is designed to be cited. We maintain stable URLs and versioned verification dates. Copy the format appropriate for your publication below.
APA
Marie Larsen. (2026, February 13). Password Reuse Statistics. Gitnux. https://gitnux.org/password-reuse-statistics
MLA
Marie Larsen. "Password Reuse Statistics." Gitnux, 13 Feb 2026, https://gitnux.org/password-reuse-statistics.
Chicago
Marie Larsen. 2026. "Password Reuse Statistics." Gitnux. https://gitnux.org/password-reuse-statistics.
Sources & references
26 datasets cited across this report · attribution is report-level
+2 additional datasets cited (not shown individually)