How One Breach Becomes Many

When a website gets hacked and user data is stolen, the stolen information typically includes email addresses and password hashes — a scrambled version of the password that can be reversed with enough computing power. Attackers run these hashes through specialised software until they've recovered the original passwords.

The Consequences Are Rarely Dramatic

When people imagine getting "hacked," they tend to picture someone actively taking control of their computer, reading their files, watching their screen. This almost never happens in credential stuffing attacks. The reality is more mundane — and in some ways more costly.

How to Check If You're Already Exposed

Before changing anything, it's worth knowing whether your email address has already appeared in a known data breach. HaveIBeenPwned.com is a legitimate, widely respected service run by security researcher Troy Hunt that lets you enter an email address and see which breaches it has appeared in. It's free, requires no registration, and is referenced by cybersecurity organisations worldwide.

The Fix: Two Components

A no-logs VPN for the network layer. Password reuse is the credential-layer problem. There's a separate but related risk at the network layer: if you're logging into accounts on public Wi-Fi — a hotel, an airport, a café — and the connection is unencrypted, the credentials you type can potentially be observed by others on the same network.

A no-logs VPN encrypts your connection before it leaves your device, so the network you're on can't see what you're transmitting. For people who've adopted better credential hygiene and want to protect the transmission of those credentials in transit, this is the complementary step. The no-logs policy specifically matters here: if you're being thoughtful about which services hold records of your activity, choosing a VPN provider that doesn't log connection data is consistent with that same thinking.

X-VPN doesn't store connection logs and is available on the Microsoft Store for Windows users — a verified install path that doesn't require evaluating the safety of a third-party download.

The Order of Operations

If you're going to fix this properly, the order matters:

First, check HaveIBeenPwned to understand your current exposure. Second, install a password manager. Third, work through your most important accounts — email, banking, work accounts — and change those passwords to unique ones generated by the manager.