Passwords from more than 29,000 corporations were put at risk. How do we prevent a situation like this?

You can’t control a supplier’s security, but you can limit the damage from an attack like this one: with two-step verification on all important accounts, with a unique password for each account, changed as soon as the supplier announces a breach, and by paying close attention to the emails that show up afterwards.

What happened to Passwordstate in April 2021?

In April 2021, a group of hackers compromised the Passwordstate password manager, as Ars Technica reported at the time. According to the manufacturer, the application is used by more than 29,000 companies, with more than 370,000 users, IT and security professionals.

Click Studios, the app’s maker, announced that the attackers had managed to slip a malicious program into the app’s built-in update mechanism (In-Place Upgrade). Customers who updated the app this way between April 20 and 22, 2021, in a window of about 28 hours, installed the malicious program along with the update; researchers at CSIS named it Moserpass. It sent the attackers information about the server and, according to Click Studios, the passwords saved by affected customers may have reached the attackers. Manual updates weren’t compromised.

So the attack didn’t expose the passwords of all 29,000 companies: Click Studios said the number of affected customers appeared to be “very small”. However, any customer could have installed the update in that window, and the manufacturer asked those affected to change all the passwords saved in the app. A few days after the attack, phishing emails also appeared that imitated Click Studios’ messages and spread a new variant of the malicious program.

Why do companies use password managers?

Password manager apps are very popular in corporate environments, where security policies require complex passwords that are often hard to remember. Without such apps, users would have to write their passwords down in various places, which would create major security gaps.

Passwordstate is a proprietary password manager, sold mostly to companies, which install it on their own servers. It’s typically used to store VPN passwords, to log in to certain applications, or even to access network equipment.

Users who had two-step verification on the services whose passwords were in the vault were better protected: the attackers couldn’t log in with the password alone, without the “second login method”. Even so, the passwords had to be changed as a precaution.

The lesson of the attack isn’t to give up on password managers. A well-protected password vault remains much safer than reused passwords or passwords written down on paper. What matters is protecting it with two-step verification and knowing in advance what you’ll do if the supplier announces a breach.

What is a supply chain attack?

It’s an attack in which hackers don’t target the company directly, but one of its suppliers: a program, an update or a service company through which they then reach the customers. The Passwordstate case resembles the attack on SolarWinds, discovered in December 2020, in which a compromised update of the Orion software reached thousands of organizations.

For companies that fall under NIS2, risk coming from suppliers is no longer just a technical problem: GEO 155/2024, which transposes Directive (EU) 2022/2555 into Romanian law, also requires them to keep supply chain security under control.

Tips for choosing secure passwords

• Use random password generators, such as those in password managers or in your browser: that way, you’ll always choose secure passwords that are different for each account. You’ll find more in the article with basic rules for creating secure passwords.
• Turn on two-step verification wherever you can. That way, each login also has to be confirmed from a second device: an authenticator app installed on your phone, a security key or, the weakest option, a code received by SMS.
• Use passkeys where they’re available. Supported today by Microsoft, Google and Apple, they replace the password with a confirmation on your phone or computer, and they resist phishing.
• Delete the accounts you no longer use. That reduces the number of places your data can be stolen from.
• Check the activity on your accounts regularly. If you notice unusual logins, change the password urgently.
• Check whether your email address has appeared in known breaches on Have I Been Pwned, and change the passwords of the affected accounts.
• Watch out for the emails that follow a breach. Attackers use the news of the attack to send fake messages in the supplier’s name; we explain how to recognize them in the article on phishing attacks.

How does a company protect its employees’ passwords in 2026?

With rules applied centrally, not left up to each employee:

• a password manager for the team, with the vault protected by two-step verification and with each person given access only to the passwords they need;
• mandatory two-step verification on email (Microsoft 365 or Google Workspace), on the VPN and on administrator accounts;
• accounts closed as soon as an employee leaves the company;
• passwords changed whenever you change IT providers;
• a written incident plan: who changes the passwords, in what order, and whom you notify.

Find out how well your company does on these points with a free IT audit.

RezolvIT is an ISO/IEC 27001-certified IT outsourcing company that helps businesses with securing their infrastructure and with their employees’ remote work. We set up accounts for new employees and close access for those who leave, and when we take over IT from another provider, the written plan, ready within 24 hours at most, includes changing the passwords. You’ll find details on the IT security page.