After a Breach: Securing a Compromised Account

When someone breaks into an account, they typically get a live session, not just a password — changing the password afterward does not close a session that is already open, so the account has to be explicitly signed out of every device for that access to actually end. Leaked passwords are valuable on their own, too: attackers take password lists from one breached site and try them against unrelated accounts, a technique called credential stuffing, which is why reusing a password anywhere makes every account that shares it only as safe as the weakest site it was used on. Email is usually the single most important account to protect, because most other sites let a stranger take over just by requesting a password reset sent to that inbox.