Surprise! Microsoft says 44 million users are using duplicate passwords

Microsoft conducted a security threat assessment of its services and users between January and March this year, and the results are shocking. According to the Microsoft Threat Research Team, millions of users are reusing their passwords on Microsoft services.

As part of the threat assessment, Microsoft checked 3 billion credentials, of which 44 million Microsoft services and Azure AD accounts were matched, indicating that the above accounts are reusing credentials. Microsoft also pointed out that many of the 3 billion credentials were leaked online, and the company forced password resets to ensure that accounts are not abused.

Microsoft also noted that 30% of reused or modified passwords can be cracked in just 10 guesses. This triggers a breach replay attack, where an attacker gains access to one set of credentials and uses similar credentials to break into other accounts as well.

Microsoft urges users to improve their password security posture and use MFA, as 99% of attacks can be prevented by using "multi-factor authentication." In addition, Microsoft always recommends using unique passwords whenever possible, and even unique usernames, to make it difficult for attackers to guess and gain access.