· By Chris Kirby
Password managers: why reusing passwords puts your small business at risk
Most of us have a "usual" password. Maybe it's a pet's name with a number on the end, or a slightly varied version of something we came up with years ago. It works, it's easy to remember, and it gets used for the business email, the accounting software, the supplier portal and the online bank.
It feels harmless. But reused passwords are one of the simplest ways criminals get into small businesses, and they don't need any clever hacking to do it.
Why one password everywhere is a problem
Websites and online services get breached all the time. When they do, lists of email addresses and passwords often end up being shared or sold by criminals.
The National Cyber Security Centre (NCSC), the UK's official cyber security body, puts the risk plainly: if you use the same password across different accounts and one of them is compromised, a hacker can try the same password on your other accounts and potentially get into them too (NCSC).
This is known as "credential stuffing". Criminals take login details stolen from one place and try them automatically on lots of other sites. They don't need to know who you are. They just need you to have used the same password somewhere else.
So a breach at a website you signed up to years ago, and have since forgotten about, can become the key to your business email today.
A real example: 23andMe
In June 2025, the Information Commissioner's Office (ICO), the UK's data protection regulator, fined the genetic testing company 23andMe £2.31 million after a large cyber attack in 2023 (ICO).
According to the ICO, the attacker carried out a credential stuffing attack between April and September 2023, using reused login details that had been stolen in previous, unrelated data breaches. Personal information belonging to 155,592 UK residents was accessed (ICO; BBC News).
The ICO's findings included that the company had not put in place appropriate login protections, such as mandatory multi-factor authentication and secure password measures.
There are two lessons here for a small business. First, the password a customer or employee reuses can become your problem, not just theirs. Second, regulators expect businesses that hold personal data to take sensible steps to protect it.
Why does business email matter so much?
For most small businesses, the email account is the master key. It's where password reset links arrive, where invoices are sent and received, and where customers and suppliers expect to hear from you.
If a criminal gets into it using a reused password, they can quietly read conversations, reset passwords for other services, or send convincing messages from your real address. As we covered in our post on invoice fraud, a message from a genuine, trusted email account is far more believable than one from a lookalike.
What is a password manager?
A password manager is a tool that stores your passwords safely, so you don't have to remember them all. Because it remembers them for you, every account can have its own long, unique password.
The NCSC recommends using one, and notes several other benefits (NCSC):
- it can create strong, unique passwords for each account;
- it can fill in your password automatically, and because it only does that on the correct website, it can help protect you against fake login pages used in phishing;
- it can keep your passwords in step across your devices;
- many will warn you if one of your passwords has turned up in a known breach.
You may already have one without realising. The NCSC points out that major browsers such as Chrome, Edge and Safari can create and save passwords, and that this is safe on your own devices. Separate "third-party" password managers are also available, and can be handy when a team uses a mix of devices and browsers. The NCSC's advice is that the best one is the one that meets your needs and that you find easiest to use.
Passwords aren't the whole story
A password manager makes unique passwords practical, but the NCSC is clear that the first and most important step is turning on two-step verification (also called multi-factor authentication) for important accounts. That way, even if a password is stolen, it isn't enough on its own. The NCSC also advises switching it on for the password manager itself.
Looking further ahead, the NCSC now recommends passkeys as the first choice of login wherever they are offered. A passkey lets you sign in using your device's existing unlock method, such as a fingerprint, face check or PIN, rather than typing a password at all. For accounts that don't yet offer passkeys, the NCSC's advice remains a strong, unique password plus two-step verification.
Why it matters for small businesses
The NCSC says there are 5.5 million small organisations in the UK, and that small businesses are just as likely to experience online crime as larger ones (NCSC).
Small firms often share logins between staff, keep old accounts open long after they're needed, and rely on whatever password was set up on day one. None of that is unusual, and none of it is a failing. But it does mean a single leaked password can travel a long way.
The good news is that this is one of the cheaper, calmer fixes in cyber security. It's mostly about habits, not expensive technology.
Where do you stand?
An outside check can't see your passwords, and it can't tell whether you reuse them. That's something only you can look at from the inside.
What Tidy Cyber's free check can do is give you a plain-English view of what your business looks like from the outside: your website security, email protection, and certificate and domain basics. It's a quick, jargon-free way to spot anything public-facing that may have been left behind, alongside a look at your own logins.