Introduction
Most internet users have created dozens—sometimes hundreds—of online accounts over the years. These may include old social media profiles, shopping websites, gaming services, forums, and apps that were only used once.
The problem is that many of these accounts are never deleted.
These forgotten profiles are known as dormant accounts, and cybersecurity experts say they can create hidden security risks. Because they are rarely monitored, they may become easy targets for attackers looking to gain access to personal information or reuse login credentials.
Understanding why dormant accounts are valuable to hackers—and how to secure them—can help reduce a common but overlooked security risk.
Why Dormant Accounts Are Attractive to Hackers
Dormant accounts often lack active security monitoring, making them appealing targets for attackers.
Several factors contribute to the risk.
Weak or Old Passwords
Many older accounts were created before modern password practices became common.
Users may have reused simple passwords across multiple websites. If one site experiences a data breach, attackers may attempt to reuse the stolen credentials on other platforms.
This technique is known as credential stuffing.
No Monitoring or Login Alerts
Because dormant accounts are rarely used, unusual activity may go unnoticed for long periods.
For example, if an attacker successfully logs into an old account, the owner may not receive alerts or may simply miss them.
This lack of oversight allows attackers to maintain access without immediate detection.
Credential Reuse Across Services
Many users reuse the same password across multiple services.
If login credentials from an inactive account appear in a data breach, attackers may try those same credentials on widely used platforms such as:
- Gmail
- Banking sites
- Work accounts
- Cloud storage
Even if the breached account itself is unimportant, reused credentials can provide attackers access to more valuable accounts.
Outdated Security Features
Older accounts may lack modern security features such as:
- Two-factor authentication (2FA)
- Login alerts
- Device verification
- Suspicious activity monitoring
This makes them easier to compromise.
Personal Information Still Stored
Many old accounts still contain personal information such as:
- Full name and address
- Phone numbers
- Payment details
- Date of birth
- Security questions and answers
This data can be valuable for identity theft or targeted attacks.
Real Security Incidents Involving Dormant Accounts
Dormant accounts have played a role in several cybersecurity incidents.
Data Breaches of Old Services
When companies experience data breaches, the stolen databases often include millions of old user accounts.
Attackers frequently analyze these databases to extract:
- Email addresses
- Password hashes
- Account recovery details
- Personal information
Even if the original service is no longer used, the exposed credentials may still work elsewhere if users reused passwords.
The 2021 Facebook Data Leak
In one well-known incident, data from hundreds of millions of Facebook users was exposed. Many of the affected accounts were old or inactive, but the leaked information was still used for phishing and spam campaigns.
Credential Stuffing Attacks
Major platforms regularly report blocking millions of credential stuffing attempts. Many of these attempts use login combinations from old data breaches.
How Hackers Use Dormant Accounts
Once attackers gain access to an inactive account, they may use it for several purposes.
Identity Impersonation
Old social media accounts may still contain personal photos, messages, and connections.
Attackers can take control of these accounts and impersonate the original owner to:
- Send phishing messages to friends and family
- Scam connections with fake requests
- Spread misinformation
- Damage reputation
Spam and Phishing Campaigns
Compromised accounts can also be used to send spam or phishing messages, especially if they appear trustworthy.
Messages coming from real accounts are often more convincing than those from newly created profiles.
Access to Personal Data
Some older services may still store personal data such as addresses, phone numbers, or payment information.
If attackers gain access, this data could potentially be used in identity theft or targeted scams.
Building Credential Lists
Attackers collect login credentials from compromised accounts to build large databases of email and password combinations.
These lists are then used for credential stuffing attacks on other platforms.
Selling Account Access
Some hackers sell access to compromised accounts on underground forums. Even old, inactive accounts have value for certain purposes.
The Scale of the Problem
Research suggests that the average internet user has:
- 100+ online accounts
- 20-30 actively used
- 70+ dormant or forgotten
With billions of internet users worldwide, this represents hundreds of billions of dormant accounts—a massive potential attack surface.
How to Find Forgotten Accounts
Locating dormant accounts can take time, but several methods can help identify them.
Check Your Password Manager
If you use a password manager, it likely contains a list of websites where accounts were created.
Reviewing this list can reveal services that are no longer used.
Popular password managers include:
- 1Password
- Bitwarden
- Dashlane
- Keeper
- LastPass
- Proton Pass
These tools can help organize and manage account credentials.
Search Your Email Inbox
Another effective method is searching your email inbox for account-related messages.
Useful search terms include:
- “welcome”
- “verify your account”
- “confirm your email”
- “account created”
- “activation”
- “registration”
- “thank you for joining”
- “reset your password”
These emails often reveal services where accounts were previously registered.
Check Browser Saved Passwords
Most browsers can save passwords for websites.
To check saved passwords:
In Chrome:
- Settings → Autofill and passwords → Google Password Manager
In Safari:
- Preferences → Passwords
In Firefox:
- Settings → Privacy & Security → Saved Logins
In Edge:
- Settings → Profiles → Passwords
Review App and Service Permissions
Many users sign up for services using single sign-on systems like:
- Google Sign-In
- Apple ID
- Facebook Login
- Sign in with Amazon
Checking connected apps in these accounts may reveal services you no longer use.
To check connected apps:
Google: myaccount.google.com/permissions Apple: appleid.apple.com (Sign in with Apple) Facebook: Settings → Apps and Websites Microsoft: account.microsoft.com/privacy
Use Data Breach Monitoring Services
Services like Have I Been Pwned can show which email addresses have appeared in known data breaches.
This can help identify old accounts that may have been compromised.
Check Old Devices
Old phones, tablets, or computers may still have apps installed or browser logins saved from past accounts.
How to Secure Dormant Accounts
Once dormant accounts are identified, several steps can help reduce security risks.
Delete Unused Accounts
If an account is no longer needed, deleting it is often the safest option.
Many websites provide account deletion options in the account settings or privacy section.
Removing unused accounts reduces the number of potential attack targets.
Tips for account deletion:
- Look for “Delete account,” “Close account,” or “Deactivate” options
- Some sites require submitting a request via customer support
- Save any important data before deletion
- Check if the account can be permanently deleted or only deactivated
Update Passwords
If an account must remain active, updating the password is essential.
Use a unique and strong password that is not reused on other services.
Password managers can help generate secure passwords automatically.
Password best practices:
- At least 12-16 characters
- Mix of letters, numbers, and symbols
- No personal information (names, birthdays)
- Unique for every service
Enable Authentication Protection
Many online services support additional authentication protections, such as:
- Two-factor authentication (2FA)
- Authentication apps (Google Authenticator, Microsoft Authenticator)
- Security keys (YubiKey, Titan)
- Biometric verification
Enabling these features significantly reduces the risk of unauthorized access.
Review and Update Recovery Information
Ensure that account recovery options are current:
- Recovery email address
- Phone number
- Security questions
Outdated recovery information can make it difficult to regain access if needed.
Remove Personal Information
If you keep an account but rarely use it, consider removing stored personal information:
- Delete saved addresses
- Remove payment methods
- Clear profile information
- Delete stored content
Monitor for Breaches
Use breach monitoring services to receive alerts if your email appears in new data breaches.
Account Cleanup Checklist
Use this checklist to audit and secure your online accounts:
- List all accounts you can remember
- Check password manager for saved accounts
- Search email for account creation messages
- Review browser saved passwords
- Check connected apps on Google, Apple, Facebook
- Run email through breach monitoring services
- Delete accounts no longer needed
- Update passwords for accounts you keep
- Enable two-factor authentication where available
- Review and update recovery information
- Remove personal data from unused but kept accounts
- Set a reminder for annual account review
Why Dormant Account Security Matters
Dormant accounts are often overlooked in personal cybersecurity strategies.
However, each unused account represents a potential entry point for attackers—especially if it contains outdated passwords or personal information.
Regularly reviewing and securing online accounts helps reduce digital exposure and improves overall online safety.
The Domino Effect
A compromised dormant account can lead to:
- Credentials used in credential stuffing attacks
- Other accounts accessed with reused passwords
- Personal information exposed
- Identity theft or fraud
- Reputation damage from impersonation
Peace of Mind
Taking control of your digital footprint provides peace of mind. Knowing that old accounts are secured or deleted removes a source of potential anxiety.
Tools to Help Manage Dormant Accounts
Several tools can assist in finding and managing old accounts.
Password Managers
Password managers not only store credentials but also help identify:
- Which accounts you have
- Where passwords are weak or reused
- Which accounts may be inactive
Breach Monitoring Services
- Have I Been Pwned - Check if your email appears in data breaches
- Firefox Monitor - Breach monitoring with alerts
- Google Password Checkup - Check saved passwords against breaches
Account Deletion Directories
Some websites maintain directories of account deletion instructions:
- AccountKiller
- JustDeleteMe
- DeleteMe
These resources can help find deletion options for specific services.
Special Considerations
Old Email Accounts
Old email accounts themselves can be a major risk because they may be used for password resets on other services.
If you have an old email account:
- Keep it secure with a strong password and 2FA
- Consider setting up forwarding to a current address
- Delete it if no longer needed (but check for linked accounts first)
Work or School Accounts
Accounts from past employers or schools may still exist.
Contact the organization to have them closed if they are no longer needed.
Social Media Archives
Before deleting old social media accounts, consider downloading an archive of your data if you want to keep any content.
Most platforms offer data download options in settings.
The Business Perspective
For organizations, dormant employee accounts create similar risks.
When employees leave, their accounts should be:
- Promptly deactivated
- Securely archived if needed
- Removed from access lists
Failure to manage dormant accounts has led to numerous business security incidents.
Conclusion
Most internet users accumulate dozens of online accounts over time, many of which are eventually forgotten.
These dormant accounts may appear harmless, but they can create security vulnerabilities if left unmanaged.
By identifying unused accounts, deleting unnecessary ones, and strengthening login protections, users can significantly reduce the risk of account takeover attacks.
Managing dormant accounts is a simple but important step toward maintaining better digital security.
Take some time this week to review your digital footprint. The effort may save you from future security headaches.
🔐 Take control of your online accounts. Download our “Digital Account Cleanup Guide” with step-by-step instructions and checklists.
Related Resources
Internal Cyvack Guides
- Your Email Address Is Probably in a Data Breach — Here’s How Hackers Use It
- SIM Swap Attacks Are Still Stealing Online Accounts — Why Phone Numbers Are a Weak Security Layer
- Hackers Are Stealing Google Accounts Using Session Cookie Attacks — How to Protect Your Login
- Your Browser Autofill Could Be Leaking Personal Data — The Hidden Security Risk Most Users Ignore
- Shadow AI Is Becoming a Corporate Security Risk — What Companies Are Missing
Account Security Resources
Breach Monitoring
- Have I Been Pwned - Check email addresses against known breaches
- Firefox Monitor - Breach monitoring and alerts
- Google Password Checkup - Check saved passwords
- Apple Password Monitoring - Password security recommendations
Password Managers
Two-Factor Authentication
Account Deletion Guides
- JustDeleteMe - Directory of account deletion links
- AccountKiller - Account removal guides
- DeleteMe - Personal information removal service
Educational Resources
Articles and Guides
- Credential Stuffing Explained
- Password Security Best Practices
- Two-Factor Authentication Guide
- Digital Hygiene Checklist
Videos and Tutorials
- How to Find Old Accounts
- Setting Up a Password Manager
- Enabling Two-Factor Authentication
- Checking for Data Breaches
Frequently Asked Questions
Q: How do I delete an account if the website no longer exists?
If a service has shut down, there may be nothing to delete. However, be aware that data may still exist in backups or archives.
Q: What if I can’t remember the password to an old account?
Use password reset options if you still have access to the recovery email. If not, the account may be unrecoverable.
Q: Should I delete old accounts or just change passwords?
Deleting is safest if you’ll never use the account again. If you might need it, update the password and security settings.
Q: How often should I review my online accounts?
An annual review is a good practice. Some people do this at the start of each year or on a birthday.
Q: Can dormant accounts really be used to hack my other accounts?
Yes, especially if you reused passwords. Attackers use credential stuffing to try known email/password combinations on other sites.
Q: What’s the most important step to protect old accounts?
For accounts you keep, enable two-factor authentication. For accounts you don’t need, delete them entirely.
Q: How do I know if my old account was in a data breach?
Use breach monitoring services like Have I Been Pwned to check email addresses against known breaches.
Q: Is it safe to keep old social media accounts?
Old social media accounts can be targeted for impersonation. Either secure them with strong passwords and 2FA, or delete them.
Glossary of Terms
- Dormant Account: An online account that is no longer actively used
- Credential Stuffing: Automated attack using stolen username/password pairs
- Data Breach: Security incident where sensitive data is exposed
- Two-Factor Authentication (2FA): Additional security layer beyond passwords
- Password Manager: Tool that stores and generates secure passwords
- Single Sign-On (SSO): Using one account (Google, Apple) to log into multiple services
- Identity Theft: Fraudulent use of someone’s personal information
- Digital Footprint: Trail of data created by online activities
