Wag the password: Public sector suffers from password exposure
How well do governments handle password security?
For years, NordPass has analyzed exposed passwords belonging to businesses and individuals. For the first time, in 2025, we looked at the passwords used by public sector employees.
Leaks and breaches in the public sector are particularly dangerous. They don’t affect just the organization or its employees but can threaten the security of citizens at large.
Cybersecurity incidents related to public sector passwords may also pose a serious risk to a country’s strategic interests.
Research breakdown
Methodology
Threat exposure management platform NordStellar monitored passwords from public sector institutions in the United States, the United Kingdom, Canada, France, Italy, and Germany, based on their email domains.
5,500 organizations
The research covers over 5,500 organizations in six countries, monitoring national and federal parliaments, presidencies, local and regional governments, municipalities, and other public institutions.
Data exploitation
The analysis covered credentials exposed in 2024-2025 to account for recency, password relevance, and potential use to access civil servants’ accounts.
Overview of data exposure in the public sector
Based on the findings, thousands of data points belonging to public sector employees in six countries, including email addresses, first and last names, phone numbers, and other personally identifiable information, have been exposed since the beginning of 2024.
| Country | Number of exposed passwords | Number of unique exposed passwords |
|---|---|---|
| United States | 53,070 | 2,241 |
| France | 19,538 | 1,805 |
| Italy | 13,613 | 1,502 |
| United Kingdom | 3,014 | 434 |
| Germany | 1,365 | 150 |
| Canada | 506 | 77 |
Among all exposed data points, we identified over 91 thousand passwords matching email addresses with relevant public sector domains.
If affected passwords weren’t updated following the related incidents and multi-factor authentication wasn’t switched on, attackers could have potentially accessed these accounts and other sensitive information, creating serious data security risks.
Even in instances where a password didn’t match an email address, other exposed data points could be exploited for phishing attacks.
Risks lurk at every governing level
Our findings have debunked the common misconception that national and federal institutions are better protected against cybersecurity threats and that local public sector organizations are more susceptible to attacks.
Although the majority of exposed credentials were traced back to regional and municipality level institutions like administrations and local governments, the national and federal government weren’t spared by cybercriminals either.
Passwords and other personally identifiable data can be stolen even without causing major breaches or exploiting organizational vulnerabilities. Cybercriminals can exploit social engineering attacks against individual employees or breach other organizations that handle data related to public sector institutions.
| Name | unique / total passwords |
|---|---|
| U.S. Department of Defense (mail.mil) | 222 / 1897 |
| U.S. Department of State (state.gov) | 190 / 15272 |
| U.S. Army (army.mil) | 167 / 1706 |
| Government of the District of Columbia (dc.gov) | 57 / 562 |
| U.S. Department of Veterans Affairs (va.gov) | 53 / 1331 |
| City of Virginia Beach (vbgov.com) | 46/ 318 |
| Government of Illinois (illinois.gov) | 38 /879 |
| U.S. Coast Guard (uscg.mil) | 27 /393 |
| Government of Utah (utah.gov) | 25 / 514 |
| Government of Michigan (michigan.gov) | 23 / 3161 |
Exposure threatens national institutions
Our analysis focused particularly on passwords used by employees at the national and federal levels — parliaments, governments, ministries, departments, and presidential administrations — across six countries.
The findings are alarming: Even employees working at these critical national institutions can be impacted by password exposure, as seven compromised passwords were linked directly to the White House.
Findings
Key takeaways
Although over 91 thousand exposed passwords were found during the research period, the real number of compromised credentials may far exceed that. Cybercriminals don’t share or sell their loot right away — it may take months or even years for a password compromised today to show up on the dark web or illicit marketplaces.
Although many officials and public sector employees experienced data loss that did not directly impact their passwords, it doesn’t mean their personally identifiable data is safe. The scope of data exposure affected other information, such as names, addresses, phone numbers, autofill data, and cookies — all of which can be leveraged in future attacks, like social engineering.
Public sector employees were more likely to adhere to password usage recommendations set by the National Institute of Standards and Technology (NIST), a US government agency under the Department of Commerce. Compared to personal and business passwords, public sector credentials were more likely to be complex, using a mix of letters, numbers, and special symbols.
Best tips for password safety
Avoid falling victim to cyberattacks due to irresponsible credential management by following the best password management practices recommended by cybersecurity experts at NordPass.
Use strong passwords or passphrases
We recommend using passwords that are at least eight characters long and include a random mix of upper- and lowercase letters, numbers, and special symbols. Similarly, consider using passphrases — a long string of random words that only you know and use to authenticate your identity.
Never reuse passwords
The key rule to account security is using unique passwords for every account. If you reuse the same password for multiple accounts and one of them gets breached, the rest of your accounts with the same login credentials will be at risk of being compromised too.
Set up a password policy for your organization
Create a centralized standard for every employee to help safeguard employee accounts and sensitive data. With a password manager, companies can effectively manage credentials by setting up rules within the organization or specific departments. Some password managers like NordPass include additional security features like Data Breach Scanner and Password Health to alert employees if their data is vulnerable or breached.
Turn on multi-factor authentication (MFA)
Add an extra layer of security to your organization’s accounts. Multi-factor authentication helps maintain more secure access to internal systems and email accounts, keeping cybercriminals out even if a password gets breached.