More than 3 million email addresses found in data stolen by infostealers over the past year are no longer used by their owners. Some of them are abandoned but still active and pose a security risk. Millions more zombie accounts lurk on once-popular services like Groupon, dating apps people have ghosted, fitness services users gave up on, social media platforms, online shops, and even outdated work tools.
Key findings:
- One year’s harvest. NordPass’ study examined 66.5 million unique email addresses harvested by infostealer malware over the past year and checked whether each address’s domain could still receive emails by checking publicly available DNS records.
- Dangerous impersonators. The most concerning finding involves misspelled versions of major email providers. About 1% of all stolen addresses (664,000) are registered on live look-alike domains like “gamil.com.” Researchers add that some of those credentials may have been harvested when the person simply wanted to access their existing account — for example, on gmail.com — but accidentally typed “gnail.com” and logged in there. These domains work and receive emails. They’re just owned by someone else. In total, the researchers found more than 2,500 such look-alike domains mimicking Gmail, Hotmail, Outlook, Yahoo, and iCloud.
- The dead can rise. Another 4% — 2.6 million addresses — are dead. The domains have expired, reject incoming emails, or never existed. But expired domains can be bought and re-registered by anyone, giving the new owner control over every account still linked to those addresses.
- The harmless dead. The research also found that nearly one in 14 leaked credentials (7%, or 4.7 million addresses) come from throwaway inboxes, while another 2.1% use disposable email services like YOPmail or Mailinator. Both were built to be abandoned.
The issue extends well beyond email. A March 2025 Secure Data Recovery survey found that up to 40% of users hadn’t logged in to accounts on services like Pandora and Groupon for over a year. For many other services named in the survey, including Dropbox, Tumblr, Duolingo, Kickstarter, and Tinder, more than 30% of respondents admitted they had an account they hadn’t signed in to for at least 12 months.
Made for harvesting data
“Accounts created on look-alike domains are probably the most dangerous because those websites are essentially built to steal credentials — cybercriminals actively buy up common misspellings of famous brand names and expired domains to inherit their traffic and reputation, then use them for credential harvesting and intercepting emails intended for the original owner. After entering their details on such a fake page, users are typically shown an error or redirected to the real site — none the wiser. But their account data stays with the attacker,” says Karolis Arbaciauskas, head of product at NordPass and its parent organization Nord Security.
Other deserted accounts — on dating apps, photo services, and online shops, including AliExpress, Shein, and Temu — are also a security risk. The data shows that in the last couple of years, Western shoppers, including Americans, have been leaving Chinese retail marketplaces, but the number of accounts that were just abandoned and not properly deleted remains unknown.
“These zombie accounts stay online with your email address and password attached, and threat actors treat them as an easy source of data. Many are missing security updates and have no two-factor authentication, so attackers can break in with simple password-spraying attacks, testing a handful of common passwords across thousands of accounts. And since most of those abandoned accounts are linked to the owner’s main email address, the stakes are high,” says Arbačiauskas.
Most people reuse passwords or choose easy-to-guess combinations, so a compromised main email address can cascade into total account takeover. “If attackers get into your main email account, they can lock you out of everything else, steal your identity, drain your bank account, or hold your data for ransom,” says Arbačiauskas.
How to stay safe:
- Delete unused accounts. To reduce the risk, review the services you’ve signed up for and delete your account if you no longer use the app, service, or platform.
- Update the recovery email address. Check whether your old email addresses still exist and update the recovery email address on accounts that matter.
- Never reuse passwords. Create strong, unique passwords for every account — a password manager can help you keep track of them. Otherwise, if one account gets broken into, all others are also at risk.
- Use MFA. Whenever possible, enable multi-factor authentication for additional protection.
Related
This entry was posted on October 29, 2026 at 3:34 pm and is filed under Commentary with tags Nordpass. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
Guest Post: Put your zombie accounts to rest forever
More than 3 million email addresses found in data stolen by infostealers over the past year are no longer used by their owners. Some of them are abandoned but still active and pose a security risk. Millions more zombie accounts lurk on once-popular services like Groupon, dating apps people have ghosted, fitness services users gave up on, social media platforms, online shops, and even outdated work tools.
Key findings:
The issue extends well beyond email. A March 2025 Secure Data Recovery survey found that up to 40% of users hadn’t logged in to accounts on services like Pandora and Groupon for over a year. For many other services named in the survey, including Dropbox, Tumblr, Duolingo, Kickstarter, and Tinder, more than 30% of respondents admitted they had an account they hadn’t signed in to for at least 12 months.
Made for harvesting data
“Accounts created on look-alike domains are probably the most dangerous because those websites are essentially built to steal credentials — cybercriminals actively buy up common misspellings of famous brand names and expired domains to inherit their traffic and reputation, then use them for credential harvesting and intercepting emails intended for the original owner. After entering their details on such a fake page, users are typically shown an error or redirected to the real site — none the wiser. But their account data stays with the attacker,” says Karolis Arbaciauskas, head of product at NordPass and its parent organization Nord Security.
Other deserted accounts — on dating apps, photo services, and online shops, including AliExpress, Shein, and Temu — are also a security risk. The data shows that in the last couple of years, Western shoppers, including Americans, have been leaving Chinese retail marketplaces, but the number of accounts that were just abandoned and not properly deleted remains unknown.
“These zombie accounts stay online with your email address and password attached, and threat actors treat them as an easy source of data. Many are missing security updates and have no two-factor authentication, so attackers can break in with simple password-spraying attacks, testing a handful of common passwords across thousands of accounts. And since most of those abandoned accounts are linked to the owner’s main email address, the stakes are high,” says Arbačiauskas.
Most people reuse passwords or choose easy-to-guess combinations, so a compromised main email address can cascade into total account takeover. “If attackers get into your main email account, they can lock you out of everything else, steal your identity, drain your bank account, or hold your data for ransom,” says Arbačiauskas.
How to stay safe:
Share this:
Like this:
Related
This entry was posted on October 29, 2026 at 3:34 pm and is filed under Commentary with tags Nordpass. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.