16 Billion Passwords Leaked: What Can Organizations Do if the Service Provider Fails?

The recent breach exposing over 16 billion fresh credentials, including data tied to Apple, Google, and Facebook, isn’t just another reminder for people to change their passwords. It’s a loud and urgent wake-up call for organizations that offer digital services.

Here’s the truth that doesn’t get enough attention:

Even the strongest password in the world means nothing if the service provider can’t protect it.

Whether you run a fintech platform, a customer portal, a digital marketplace or a SaaS product, your users trust you to keep their credentials safe. And in today’s threat landscape, that responsibility is heavier than ever.

The real risk: It’s not just about the user anymore

Most security advice focuses on what the user should do. For instance, you might ask your team to create strong passwords, enable MFA and avoid phishing. But what if the vulnerability isn’t the user?

What if the risk lies in how your platform stores, transmits, monitors or audits those credentials?

As a service provider, if your environment is compromised or your access controls are weak, even the most security-aware customer has no defense.

What your organization should be doing (now)

If your customers log in to your system with credentials, these are five things you cannot afford to overlook:

1. Secure Password Handling
   Ensure that passwords are stored using industry-standard encryption or hashing (e.g., bcrypt). No plaintext. No outdated MD5/SHA1. Period.
2. Protect All Authentication Workflows
   Apply HTTPS everywhere, use rate limiting to prevent brute-force attacks and ensure that login endpoints are monitored for abnormal behavior.
3. Isolate and Monitor Access to Credential Data
   Access to login-related data should be strictly limited to those who need it. Logging and real-time alerts for any unusual access are essential.
4. Implement Strong Identity Governance
   Go beyond simple username-password models. Use multi-factor authentication, session monitoring, and adaptive access controls for higher-risk actions.
5. Adopt ISO/IEC 27001 for Systematic Protection
   ISO 27001 is more than a certification - it’s a framework that ensures your entire security program is risk-driven, well-documented, regularly tested and continuously improved. It gives your customers and partners confidence that you’re doing things right.

Your responsibility doesn’t stop at the login page

If your customers log in to your platform, you are not just offering access, you are offering trust. That trust depends on how well you manage the security of their credentials. When login data is compromised due to weaknesses in your environment, it’s not simply a technical flaw. It becomes a business risk, a reputational issue and potentially a regulatory liability.

How can SGS help?

At SGS, we support service providers and digital platforms achieve digital trust throughout their organization and value chain. Our solutions include:

• ISO/IEC 27001 Certification Audit
  Evaluate whether your systems, policies and practices meet the international standard for information security, with a focus on access control, identity management and logging.
• Gap Assessments for ISO/IEC 27001 Readiness
  Identify where your current approach falls short; especially around user authentication, credential storage and secure development. Moreover, it helps you get an objective view before starting the certification process.
• Targeted ISO 27001 Training Programs
  Build internal understanding of access control principles (Clause A.5.15), logging and monitoring (A.8.15/A.8.16) and incident readiness. Ideal for technical teams, risk owners and leadership. 
• ISO 22301 Business Continuity Training
  Prepare your team to respond confidently in the event of a credential-related breach, aligning security planning with operational resilience.

The threat landscape is evolving fast. Credentials are a top target and a weak point for many organizations. You don’t need to figure it out alone, but you do need to be prepared. We’re here to help you assess, validate and upskill, so that your organization can stand behind the trust it offers.

Let us help you get ready to prove it. Contact us today.