{"id":4170,"date":"2026-05-04T12:36:17","date_gmt":"2026-05-04T19:36:17","guid":{"rendered":"https:\/\/blogschapman.wpenginepowered.com\/information-systems\/?st-import=86aecdf2e9d375b67c55bf5f4f49adbf"},"modified":"2026-07-20T15:44:08","modified_gmt":"2026-07-20T15:44:08","slug":"why-it-wasnt-a-chapman-breach-can-still-put-your-account-at-risk","status":"publish","type":"post","link":"https:\/\/blogs.chapman.edu\/information-systems\/2026\/05\/04\/why-it-wasnt-a-chapman-breach-can-still-put-your-account-at-risk\/","title":{"rendered":"Why \u201cIt Wasn\u2019t a Chapman Breach\u201d Can Still Put Your Account at Risk"},"content":{"rendered":"

As the CISO at Chapman, I often hear this understandable response when we notify someone that their credentials appeared in an external data breach:\u00a0<\/span>\u201cBut Chapman wasn\u2019t breached.\u201d<\/span><\/i><\/p>\n

That\u2019s\u00a0usually correct,\u00a0and it can still present a real risk.<\/span><\/p>\n

When breaches occur elsewhere on the internet, email addresses and passwords are\u00a0frequently\u00a0exposed. If a password used on another site was also used for a Chapman account, attackers\u00a0don\u2019t\u00a0need to compromise Chapman systems. They simply\u00a0attempt\u00a0to sign in using valid credentials.<\/span><\/p>\n

Attackers are not focused on where a password originated,\u00a0only where it still works.<\/span><\/p>\n

How Credential Reuse Leads to Account Compromise<\/span><\/b><\/p>\n

Stolen credentials are routinely added to automated testing tools that\u00a0attempt\u00a0to\u00a0log\u00a0in across common services, including university email systems.\u00a0This process doesn\u2019t rely on exploiting vulnerabilities; it relies on successful authentication.<\/span><\/p>\n

If a password is reused and still valid, the account may already be compromised.<\/span><\/p>\n

The Role and Limits of MFA<\/span><\/b><\/p>\n

Multi-Factor Authentication (MFA)\u00a0remains\u00a0one of our most effective controls and significantly reduces the likelihood of compromise. However, MFA is not immune to human factors.<\/span><\/p>\n

If an attacker already has a valid password, an unexpected MFA prompt may appear. In a busy workday, it can be easy to assume the prompt is legitimate and approve it without investigation.<\/span><\/p>\n

MFA protects systems; user awareness completes the protection.<\/span><\/p>\n

Why Annual Password Resets Still Matter<\/span><\/b><\/p>\n

It\u2019s\u00a0reasonable to ask why Chapman\u00a0requires\u00a0annual password changes, especially when MFA is in place.<\/span><\/p>\n

The answer is simple: password resets limit the lifespan of exposed credentials.<\/span><\/p>\n

External breaches are not always discovered immediately. Credentials can circulate quietly for months \u2014 or years \u2014 before they are actively abused. An annual reset ensures that even if a password was unknowingly exposed elsewhere, it will eventually become unusable.<\/span><\/p>\n

In effect, password resets:<\/span>\u00a0<\/span><\/p>\n