Quick answer: The most damaging everyday mistakes are reusing passwords, skipping multi-factor authentication, ignoring software updates, and clicking before verifying. Fixing those four closes most of the common doors. The full list of ten is below, each with a specific fix you can do in a few minutes.
Most people don’t get hacked because an expert targeted them. They get hacked because of a habit: the same password everywhere, a postponed update, a login that never asked for a second step. The good news is that habits are fixable, and the fixes are mostly free.
A Real Example: What Reused Passwords Cost 23andMe’s Customers
From April to September 2023, an attacker used credential stuffing, which means trying logins leaked in earlier, unrelated breaches, against 23andMe accounts. About 14,000 accounts were accessed directly. But because of a feature that links relatives, the personal information of around 6.9 million people was exposed, according to press coverage of the case. In the UK, the information included names, birth years, locations, family trees, and health reports, depending on what each account held.
In June 2025 the UK Information Commissioner’s Office fined 23andMe £2.31 million, finding it had not implemented appropriate authentication measures, including mandatory multi-factor authentication and secure password requirements. The Commissioner said: “23andMe failed to take basic steps to protect this information.” He added that once exposed, the data “cannot be changed or reissued like a password or credit card number.” For individuals, the regulator’s advice was plain: use strong, unique passwords, turn on multi-factor authentication, and be wary of phishing messages. Read the ICO’s announcement.
Two of the mistakes below, password reuse and skipped multi-factor authentication, are exactly what that attack relied on.
The 10 Mistakes
1. Using weak or reused passwords
A leak at one site becomes a break-in at every site where you reused the password. CISA’s guidance is to make passwords long (at least 16 characters), unique to each account, and randomly generated, ideally with a password manager. Fix: Install a password manager, let it generate unique passwords, and start with your email, banking, and shopping accounts.
2. Not using multi-factor authentication
A stolen password shouldn’t be enough to log in. CISA says multi-factor authentication makes it “significantly less likely you’ll get hacked.” Fix: Turn it on for email first, then financial, social media, and shopping accounts. Prefer an authenticator app or passkey over text messages. See our two-factor authentication guide.
3. Putting off software updates
Updates fix flaws that attackers already know about. Fix: Turn on automatic updates for your operating system, apps, and especially your web browser, on every device.
4. Clicking before verifying
CISA states that more than 90% of successful cyber-attacks start with a phishing email. Attackers also use text messages and phone calls. Fix: Don’t click links in unexpected messages. Go to the company’s app or site directly, or call the number on your card. See 5 quick ways to spot a phishing email and our guide to text scams.
5. Using public Wi-Fi without protection
On an open or fake network, an attacker may be able to see or tamper with your traffic. Fix: Avoid logging into banking or email on public Wi-Fi, check that sites use HTTPS, and use a VPN or your phone’s hotspot. See public Wi-Fi safety and why HTTPS matters.
6. Oversharing on social media
Birthdays, pet names, your workplace, and travel dates help scammers sound credible, and they answer common account-recovery questions. Fix: Tighten privacy settings, avoid posting travel plans in real time, and don’t use real facts as security answers. See how to secure your social media accounts.
7. Installing apps or files from unverified sources
Free downloads, cracked software, and unexpected attachments are common ways to deliver malware. Fix: Install apps only from official stores, read permission requests, and delete apps you no longer use. See how to check whether apps are spying on you.
8. Skipping backups
Ransomware can lock your files, and a failed drive or a stolen laptop can erase them for good. Fix: Keep at least one backup that isn’t permanently connected to your computer, and test restoring a file. See our ransomware guide.
9. Staying logged in on shared or public devices
The next person can open your email or accounts. Fix: Log out completely, don’t save passwords in the browser on shared computers, and use a private window.
10. Assuming it won’t happen to you
Attackers favor easy targets, not famous ones. The FBI’s Internet Crime Complaint Center recorded $20.877 billion in reported losses in 2025, a 26% increase from the year before, and people 60 and older reported $7.748 billion of that. These are ordinary people. Fix: Treat security as routine maintenance. The 30-minute plan below is a start. Source: IC3 2025 Internet Crime Report (PDF).
A 30-Minute Fix Plan
- Minutes 1-10: Install a password manager and change the password on your email account.
- Minutes 10-15: Turn on multi-factor authentication for that email account.
- Minutes 15-20: Turn on automatic updates on your phone and computer.
- Minutes 20-25: Check whether your email has appeared in known breaches at Have I Been Pwned, and change any password it flags.
- Minutes 25-30: Set up a backup, or schedule one for this weekend.
For tools to help, see our curated list of cybersecurity tools.
If You’ve Already Made These Mistakes
- Reused a password that was leaked: Change it everywhere you used it, starting with email and financial accounts, and turn on multi-factor authentication.
- Clicked a bad link or opened a suspicious attachment: Disconnect from the network, run a security scan, change your passwords from a different device, and watch your accounts. Report it at ReportFraud.ftc.gov or ic3.gov.
- Gave out financial details: Call your bank or card issuer using the number on your card, and see IdentityTheft.gov for recovery steps.
People Also Ask
Reusing passwords and not turning on multi-factor authentication. Together they let a single leaked password open many accounts.
Change a password when there’s a reason to: it appeared in a breach, you shared it, or you reused it. Long, unique passwords stored in a password manager don’t need scheduled changes.
It can be, with care. Use HTTPS sites, avoid sensitive logins, and use a VPN or phone hotspot when you can.
Yes, in some form. Built-in options such as Windows Defender are a reasonable baseline. See our antivirus guide.
Yes. Breaches at companies you use can expose your data regardless of your habits. That’s why unique passwords, multi-factor authentication, and backups matter: they limit the damage.
Secure your email account with a unique password and multi-factor authentication. It resets nearly every other account.
Sources: UK Information Commissioner’s Office, “23andMe fined £2.31 million for failing to protect UK users’ genetic data” (June 2025); CISA, “4 Things You Can Do To Keep Yourself Cyber Safe”; FBI Internet Crime Complaint Center, 2025 Internet Crime Report
Leave a Reply
You must be logged in to post a comment.