Inactive accounts: Real risk of cyberattacks

In today's digital world, we all accumulate online accounts that we eventually stop using. Whether it's a free subscription, an app we only try during a trip or a quick registration at an online store, those accounts are forgotten... and in many cases, unprotected. It is estimated that each person manages about 168 passwords, many associated with services they no longer use.

Although it may seem harmless, keeping inactive accounts represents a serious threat to your cybersecurity, both at a personal and business level.

The perfect target for cybercrime

Because they are abandoned, these accounts often lack basic security measures such as two-step verification, making them an easy target for cybercriminals. In addition, many of them may contain valuable personal data, accessible through methods such as:

• Spyware malware: programs designed to steal login data.

• Massive leaks: third-party security breaches that expose your passwords.

• Credential stuffing: technique that probes your leaked passwords on other platforms.

• Brute force: automated attempts to guess weak or repeated passwords.

How dangerous are inactive accounts?

On a personal level, an attacker can:

• Use your accounts to send spam or perform fraud by impersonating your identity.

• Access saved cards and commit financial fraud.

• Resell your accounts on the darkweb, especially if they contain benefits such as points or rewards.

• In the case of bank or cryptocurrency accounts, they could even withdraw funds.

In the corporate environment, the danger is even greater. A forgotten corporate account can open the door to an entire internal network.

For example, the cyberattack on a U.S. pipeline company in 2021 initiated by an inactive VPN account without hardened security.

Another case occurred in the UK, where a weak password on a forgotten account facilitated an attack on a local government.

Although these cases occurred abroad, they serve as a warning for Mexico, where many companies still do not perform frequent audits of their digital access.

How to do digital cleaning safely

The solution lies in prevention. Here are some key actions:

• Do a digital cleanup: search your email for accounts you no longer use with keywords such as “sign up,” “welcome,” or “thanks for joining.”

• Delete or secure your old accounts: change passwords and check if they have been compromised.

• Verify data deletion policies: make sure your data is deleted if you close the account.

• Enable two-factor authentication (2FA): an extra layer of security that can prevent unauthorized access.

• Avoid public Wi-Fi networks without VPN: especially when accessing services with sensitive information.

• Be wary of urgent emails or messages: they could be phishing attempts to steal your data.

In short, periodically checking your inactive accounts is as essential as changing the lock on a door you no longer use, but which is still connected to your home.

A small action can prevent significant economic and information losses.

At Cyberpeace, we invite you to take control of your digital security. Being aware of risks such as dormant accounts and other cyber threats is key to keeping your information protected. Prevention starts with knowledge. Prevention starts with knowledge. Want to learn more about how to take care of yourself in the digital world? Follow us on our networks and always stay one step ahead.

• LinkedIn 

• Facebook 

• Instagram 

• X 

• YouTube