Size the Yearly Global Volume of Stolen Login Credentials (Estimation)

Give a back-of-the-envelope estimate of how many passwords attackers compromise worldwide in one year. Show how you break the problem into parts, label each assumption, and walk through the arithmetic to a final figure. ```hint Follow the ways credentials leak Instead of guessing which people attackers target, think about the main routes by which a password ends up in an attacker's hands, and size each route from a driver you can reason about. ``` ### Clarifying Questions - Does "hacked" mean the attacker obtained the password (through a breach, phishing or malware), or that an account was actually broken into? - Should we count each stolen account password, or each person who had at least one password stolen? - If a company's database of hashed passwords is breached, does every password in it count, or only the ones attackers can actually recover? - Count only passwords newly compromised this year, or also old leaks that resurface in new compilations? ### What a Strong Answer Covers - A precise definition of what counts as a hacked password and of the unit being counted. - A clear equation that splits the estimate along a defensible dimension, such as how credentials are stolen. - Labeled assumptions with round numbers, and arithmetic that is easy to follow. - Handling of double counting across sources and of the same password being reused on several accounts. - A sanity check and a sense of which assumptions move the answer most. ### Follow-up Questions - How would your estimate change if half of all accounts used passkeys or required a second factor? - Which single assumption would you research first to tighten the range, and where would you find data for it? - As a PM on an account-security product, which source of compromise would you tackle first, and what metric would you aim to move?