While you're at it, go ahead and do some password-hygiene work on accounts that contain sensitive personal information, starting with anything hackers could use to steal your identity or your money.

Start with any credentials that you use across multiple websites, ensuring that no passwords are repeated, especially if you rely on your email or a small handful of usernames. The most important action you can take right now - seriously, this minute - is to start changing your passwords. Major data breaches occur regularly and have impacted companies like Facebook, T-Mobile, Microsoft, Walgreens and many more. Breach can be vast -, everyone who had a LinkedIn account in 2012 had their login credentials stolen, and so did everyone who had a Yahoo account in 2013. The website HaveIBeenPwned, which lets you check if a password or usernames has been exposed in a data breach, currently holds nearly 11.5 billion sets of compromised login credentials. It's not like there's any shortage of stolen credentials to work with. You don't want your accounts to be among them. If an automated tool can test 100,000 sets of credentials on a single website, then the yield could be between 100 and 2,000 accounts. While the success rate for any single credential-stuffing login attempt is estimated at between 0.1%, and 2%, your chances of falling victim aren't insignificant. They also can make malicious login requests look legitimate, which may make it hard to detect when these attacks are happening.

The tools can hammer websites with thousands of login attempts per hour. That's where the automated tools come into play. These bad actors just have to try hard enough, for long enough, to find those other accounts. The hackers now have the credentials to log into those other accounts of yours, which might contain sensitive information such as credit card numbers, bank information or private messages. Now let's say one of those four accounts is compromised in a data breach. Let's say you use the same username and password for your primary email account, your online bank account, a social-media account and an account on a shopping site. They're just not sure which accounts the credentials will unlock. Thanks to our tendency to recycle login credentials, the hackers have already acquired the usernames and passwords. The difference from regular brute-force attacks is that the guesses aren't entirely random. This method is a brute-force attack of sorts because cybercriminals will try multiple sets of credentials on multiple accounts in what amounts to a fast-paced guessing game.

Hack yahoo password online free 2015