If Chrome warns that a password appeared in a breach, change it on that site and everywhere else it was used, email first. Then move business logins into a password manager, with a different password for every account.

A new warning at sign-in

Chrome 79 arrived yesterday, and one of its changes appears as you sign in to a website. If the username and password you just used have turned up in a known data breach, Chrome now says so.

It advises changing the password. Google says the check is made on an encrypted, partial copy of the details, so it never learns the password itself.

The feature grew out of the Password Checkup extension Google released early this year, and is now part of the browser. The setting sits under Sync and Google services in Chrome's settings.

For a small business, the first warning may well land on a business account: the website's admin login, the shared email, a supplier portal.

What the warning means

It does not mean the site you are signing in to was breached. It means that username and password, together, appear in a collection of details leaked from somewhere, possibly years ago.

Usually the somewhere is another site where the same password was used. A forum, an old online shop, a service the business stopped using long ago.

These collections circulate for years. One compilation publicised in January held about 773 million email addresses, gathered from many old breaches.

The danger is reuse. Leaked details are tried automatically against email, banking and website logins, in bulk, by people who never look at whose accounts they are.

Where a business is exposed

The first turns a breach somewhere else into a problem here. A password used once can only be lost once; a password used on six accounts opens all six.

When it flags a business account

Do not dismiss it. Change that password now, to something long and used nowhere else.

Then work out where else the same password, or a close variation of it, was used, and change each one. The email account comes first, because a reset link for almost every other account goes there.

Turn on two-step verification wherever it is offered, so that a password alone is not enough to sign in.

Finally, look for signs that someone has already used it: recent sign-in activity, new forwarding rules in the mailbox, unfamiliar administrator accounts on the website, or changed payment details anywhere.

Shared accounts need a coordinated change

If several people use the account, changing the password without telling them locks them out. The new one then ends up on a note beside the monitor, which defeats the point.

Where a system allows a separate login for each person, use that instead. Then one person's change, or departure, does not disturb anyone else.

Where it does not, agree who changes it, tell everyone who uses it, and put the new password somewhere they can all reach safely.

That somewhere is the real question the warning raises.

Why the browser is not the whole answer

Chrome's saved passwords belong to one person's browser profile. When that person leaves, the passwords leave with them, and when they switch browsers, the warnings do not follow.

A business password manager is built for the job the browser is not. It creates a different password for every account, shares the ones a team needs, works across browsers and phones, and removes someone's access in one step.

Many also check stored passwords against known breaches, so a warning does not have to wait for someone to sign in.

A worked example

A travel agency with four agents and an office manager kept most of its logins in the manager's browser, plus a notebook in her desk drawer.

When Google released its Password Checkup extension early this year, she installed it, and within a day it flagged the website's admin login.

The same password was used for the agency's Instagram account and for a supplier portal the agency had stopped using years before. The leak could have come from anywhere it had ever been typed.

She changed the email password first, then the website's, adding two-step verification, then Instagram's. The old supplier account was closed rather than changed.

Over the following weeks the logins moved into a business password manager, with one shared folder for booking systems and another for the website and social accounts. The notebook went through the shredder.

Two-step verification where it counts

A breached password matters far less on an account that also asks for a code from a phone.

Start with the accounts that control the rest: email, the domain registrar, hosting, the website's admin login, and online banking. Most of these offer two-step verification now, and setting it up takes minutes per account.

Keep the backup codes somewhere the business controls, so a lost phone does not lock everyone out.

The other change in Chrome 79

The same release begins the mixed content changes Google announced in October, which concern images, scripts and other files loaded over plain HTTP on a secure page.

The next two versions extend them early next year, so a site with leftover HTTP references has a few weeks to tidy them up.

The counter-case

A sole proprietor with a handful of accounts, each with its own strong password, may find the browser's own password store adequate, provided the passwords would survive a lost laptop.

A warning on an old account nobody uses is a prompt to close it, not a crisis. And the warning is not proof that anyone has signed in; it is notice that someone could try.

For any business with shared logins, it is the moment to change what was flagged, find where else that password lives, and move the team's passwords somewhere built for a team.

When the warning appears

  1. Change the flagged password right away.
  2. Change the email password if it matched.
  3. Find every other account using it.
  4. Turn on two-step verification where offered.
  5. Check for forwarding rules and new users.
  6. Tell everyone who shares the account.
  7. Move shared logins into a password manager.

Step three is the one most people skip. Changing the flagged password closes one door, while the same password still opens every other account it was ever used for.

The mixed content changes arriving with Chrome 79 are covered in images and scripts that still load over HTTP.

Frequently asked questions

What does Chrome's breached password warning mean?

That the username and password you just used appear in a known collection of leaked details, usually from another site where the same password was used.

Was the site I signed in to hacked?

Not necessarily. The leak is usually from somewhere else, possibly years ago. The risk is that the same password works on this site and others.

What should I change first?

The flagged password, then your email password if it was the same, since password resets for other accounts go there. Then every other account sharing that password.

Does Google see my password?

Google says the check uses an encrypted, partial copy of your details, so it never learns the password itself. The setting is under Sync and Google services.

Why not keep business passwords in the browser?

Browser passwords belong to one person's profile and leave with them. A business password manager shares what the team needs and removes access in one step.

Is the warning proof of a break-in?

No. It means the details are known to people who might try them. Check sign-in activity, mail forwarding rules and website users to be sure.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Same password on the website and email?

Start with the email account today. We will check who can sign in to your website and help set up two-step verification.

Start a Conversation