How can organizations automatically disable dormant user accounts?

Identity management systems can disable accounts after a set inactivity period and trigger removal when HR records a departure. Automation reduces inconsistency compared to manual reviews across many applications.

What methods do attackers use to find forgotten accounts?

Infostealer malware and large scale data breaches expose credentials that attackers test through credential stuffing or password spraying. They also brute force weak passwords or exploit shadow IT services outside official oversight.

How should IT teams handle access for departing employees?

Offboarding should formally revoke access to email, VPNs, code repositories, and third party apps as soon as the departure is recorded. Revoking active sessions, tokens, and group memberships prevents retained access after leave.

Why are former employee accounts targeted in breaches?

These accounts often keep legitimate access to sensitive systems and may avoid regular monitoring after the person leaves. Real incidents like the Colonial Pipeline breach show they provide entry points when not disabled or protected with MFA.

What steps help individuals find and delete old accounts?

Searching your email for signup keywords like "Welcome" or "Verify account" reveals forgotten services tied to you. Reviewing password manager entries and checking provider deletion policies ensures unused profiles are closed and data is cleared.

Forgotten Accounts: How Dormant User Profiles Become a Security Risk

We create online accounts almost every day to access apps, websites, free trials, shopping platforms, and other digital services. Over time, many of these accounts are forgotten as we move on to new services, change email addresses, or stop using certain platforms. But these dormant accounts can actually create serious security and privacy risks. The problem is not limited to individuals. As organizations grow and change, employees, contractors, services, and systems come and go, but their accounts often remain active. These abandoned accounts can linger across applications and platforms without anyone monitoring or managing them. Whether personal or business-related, dormant accounts are attractive targets for cybercriminals. In this article, we explore why dormant accounts are a security threat, how cybercriminals can exploit them, and what individuals and organizations can do to identify, manage, and safely remove them.

What Are Dormant User Accounts?

A dormant user account is an account that has not been used for a defined period but remains available in a system. The period that qualifies as dormant depends on the organization, the type of account, and the system involved. The account may remain in the company's identity directory or application even though it no longer serves a purpose.

How Do Dormant Accounts Occur in Organizations?

1. Employees Leave Without Proper Account Deactivation

When an employee leaves an organization, the human resources department may notify IT about the departure. However, that notification does not always reach every application owner. Disabling the employee's primary corporate account may not automatically revoke access to independently managed cloud platforms, external services, or applications with separate user directories. As a result, former employees may retain access to systems and sensitive information long after leaving the organization.

2. Contractors and Temporary Workers Retain Access

Contractors and temporary workers create another challenge. Organizations often grant them access for a specific project or period but fail to establish automatic account expiration dates. Once the project ends, their accounts may remain active simply because nobody is responsible for reviewing or disabling them.

3. Employee Role Changes Leave Unnecessary Permissions

Business restructuring and internal transfers can also create dormant accounts and unnecessary access privileges. When employees change roles, their previous permissions may remain active alongside the access granted for their new responsibilities. Over time, users accumulate permissions they no longer need, increasing the organization's attack surface.

4. Mergers

Mergers and acquisitions can significantly increase account sprawl. Employees from an acquired company may be given new accounts within the acquiring organization while retaining access to their previous ones. This can leave duplicate accounts scattered across different services and platforms. Employees who leave during the integration process may also retain active accounts if their access is not properly revoked. In addition, service accounts connected to outdated systems may continue running long after they are needed, creating further security gaps.

5. Shadow IT

Employees sometimes sign up for online tools and services without the knowledge or approval of their organization's IT department. These may include productivity applications, development platforms, file-sharing services, and personal AI tools registered using corporate email addresses. Because these accounts exist outside official IT oversight, they can easily go unnoticed. Security teams may only discover them during a data breach investigation, security audit, or automated account scan.

How Attackers Discover and Exploit Dormant Accounts

Infostealer Malware

This type of malicious software is designed to secretly collect sensitive information, including usernames, passwords, and other login details, from infected devices. Reports estimate that 3.2 billion credentials were stolen last year, with infostealer malware responsible for approximately 75% of them.

Large-Scale Data Breaches

Hackers sometimes break into third-party companies and steal large databases containing usernames, passwords, and other personal information. If you have an account with an affected service, your login details could end up in the hands of criminals.

Credential Stuffing

Attackers use automated tools to test stolen username and password combinations across multiple websites and services. This technique is particularly effective when people reuse the same password for several accounts.

Brute-Force Attacks

In this method, hackers use automated software to repeatedly guess different password combinations until they find the correct one. Weak, predictable, or commonly used passwords are especially vulnerable.

Password Spraying

Password spraying is another technique. Rather than trying many passwords against one account, attackers test a small number of commonly used passwords against multiple accounts. This can help them avoid some account lockout thresholds, although effective monitoring and authentication controls can detect and restrict such attempts.

Send Spam and Phishing Messages

If an inactive account belongs to an email or social media service, attackers could use it to send spam, scams, or phishing messages to your contacts. They may impersonate you to trick people into sharing sensitive information or downloading malware.

Steal Personal and Financial Information

Cybercriminals may search dormant accounts for personal details, stored payment information, and other sensitive data. This information could be used for identity theft or to launch targeted phishing attacks.

Sell the Account on the Dark Web

If a dormant account contains valuable information, has an established reputation, or provides access to useful services, cybercriminals may sell it on underground marketplaces to other criminals.

Examples of Real-Life Attacks Through Dormant Accounts

1. Danish Central Person Register Breached Through Former Employee's Dormant Account (2026)

In October 2026, Denmark disclosed a major data breach involving its Central Person Register (CPR), exposing personal information belonging to approximately 8.8 million people. According to Danish media reports, an attacker exploited a former employee's account at a private company that had legitimate access to the national register. The account reportedly remained active after the employee left the company and was protected by the extremely weak password "123456", which had previously appeared in a data leak. The attacker used the compromised credentials to access the CPR system and developed automated scripts to extract personal information. The exposed information included names, home addresses, and CPR identification numbers. The register contains approximately 11 million records, including information about deceased people and individuals who have moved abroad.

2. U.S. State Government Breached Through a Former Employee's Account (2024)

In February 2024, a threat actor compromised a U.S. state government organization's network using the account of a former employee. The attacker obtained the former employee's administrator credentials, which had not been properly removed from the organization's Active Directory environment. Using these credentials, the intruder accessed an internal VPN connection and moved through the organization's network. The attacker subsequently accessed documents containing host and user information, which were posted on a dark web marketplace.

3. Colonial Pipeline Ransomware Attack Through an Unused VPN Account (2021)

One of the best-known examples of the dangers of dormant accounts is the ransomware attack against Colonial Pipeline in May 2021. The attackers gained access to the company's network through an old VPN account that was no longer in use but had never been disabled. The account did not have multifactor authentication, allowing the attackers to log in using a username and password. Investigators found that the credentials had appeared in a batch of passwords leaked from another data breach. The ransomware attack forced Colonial Pipeline to shut down its operations for nearly a week, disrupting fuel supplies across parts of the United States.

How to Reduce the Risk of Dormant Accounts

For Organizations

1. Establish a Clear Account Deactivation Policy

Every organization should define when an account must be disabled, how inactivity is measured, who approves exceptions, and who is responsible for reviewing questionable accounts. The policy should cover employees, contractors, external partners, temporary workers, privileged identities, and service accounts.

2. Automate Account Deactivation Where Possible

Manual account reviews can be inconsistent, especially when an organization manages hundreds or thousands of identities. Automation can help disable accounts after a defined period of inactivity, expire temporary accounts when their approved period ends, and trigger access removal when an employee leaves. Identity management systems can also connect personnel records with application access workflows. When a departure is recorded, the process can initiate the disabling of the user's accounts across supported systems.

3. Strengthen Employee Offboarding

When an employee leaves, access removal should be part of the formal offboarding process. IT teams should identify the systems the employee could access and ensure that unnecessary permissions are revoked promptly. This includes corporate email, cloud services, VPNs, remote administration tools, code repositories, collaboration platforms, and third-party applications. Where appropriate, organizations should revoke active sessions and authentication tokens, remove unnecessary group memberships, and disable access to connected services. The process should also cover contractors and temporary workers. Their access should expire when the engagement ends unless a documented extension has been approved.

4. Apply the Principle of Least Privilege

Accounts should have only the permissions needed to perform their authorized tasks. Regular access reviews can identify excessive privileges that accumulated when employees changed roles or received temporary access for a project. Permissions that are no longer required should be removed. Reducing unnecessary permissions limits the damage an attacker could cause if an account is compromised.

5. Enforce Multifactor Authentication

Multifactor authentication (MFA) requires users to verify their identity using an additional factor beyond a password. It can help prevent attackers from accessing an account with a stolen or guessed password alone. MFA should be required for accounts that access sensitive business resources, especially administrative accounts and remote access services.

6. Monitor Attempts to Access Disabled Accounts

Disabling a dormant account reduces the opportunity for misuse, but organizations should also monitor attempts to access accounts that have been disabled. Repeated login attempts against a deactivated account may indicate that an attacker is using old credentials, testing access, or attempting to exploit information obtained from a previous breach. Security teams should investigate suspicious activity, particularly when it involves privileged identities, multiple accounts, unusual locations, or attempts to access sensitive systems.

For Employees

Identify and Remove Dormant Accounts

Periodically review your online accounts and close those you no longer use. One way to identify forgotten accounts is to search your email inbox for terms such as "Welcome," "Verify account," "Free trial," "Thank you for signing up," and "Validate your account." These messages can help you uncover services you signed up for but have since abandoned.

Review Saved Passwords

Check your password manager and browser's saved password list for credentials linked to accounts you no longer use. Remove passwords associated with closed accounts. For accounts you still need, update any weak or compromised passwords, especially those flagged in known data breaches.

Check Account Deletion Policies

Before closing an account, review the provider's data deletion policy. Some services may retain personal or financial information even after an account is deactivated. Make sure you understand what data will be permanently deleted and what information may be kept.

Think Before Creating New Accounts

Be selective when signing up for new online services. Consider whether you really need another account and whether the service is worth sharing your personal information with. Reducing unnecessary sign-ups makes it easier to manage your digital footprint and limits the number of accounts that could become forgotten security risks.

Conclusion

Dormant accounts may seem harmless, but they can create security gaps that cybercriminals are quick to exploit. Whether they belong to individuals or organizations, forgotten accounts can expose sensitive information, enable identity theft, and provide unauthorized access to valuable systems. Regularly reviewing accounts, removing unnecessary access, and deleting those no longer in use can significantly reduce these risks.

Forgotten Accounts: How Dormant User Profiles Become a Security Risk

What Are Dormant User Accounts?

How Do Dormant Accounts Occur in Organizations?

1. Employees Leave Without Proper Account Deactivation

2. Contractors and Temporary Workers Retain Access