Time for a Halloween themed technology story? Open the (virtual) creakinbg door and enter. The average person’s digital life contains a graveyard. Old email addresses, forgotten shopping accounts, abandoned dating profiles and services that seemed essential several years ago can remain online, even when their owners have moved on. The cybersecurity problem is that forgotten does not necessarily mean deleted.
New research from NordPass, a password-management company, has turned attention towards these so-called ‘zombie accounts’: digital accounts that are no longer routinely used, monitored or managed, but which potentially remain accessible. NordPass offers tools including password management and a data-breach scanner for monitoring exposed domains and email addresses.
The central concern is: Once somebody stops paying attention to an account, they are less likely to spot suspicious activity, update an old password or strengthen its authentication. At the same time, information associated with the account does not necessarily disappear. According to research supplied to Digital Journal, NordPass examined 66.5 million unique email addresses harvested by infostealer malware during a one-year period. Researchers checked publicly available Domain Name System (DNS) records to establish whether the associated domains were still capable of receiving email.
The analysis identified more than three million email addresses that were no longer used by their owners, with some nevertheless remaining active. The research also points to a more subtle threat: look-alike email domains. Approximately 664,000 of the stolen addresses, about 1 per cent of the dataset, were registered to functioning domains imitating established providers through misspellings, such as substituting a letter in a well-known email domain.
Researchers identified more than 2,500 such look-alike domains mimicking major services including Gmail, Hotmail, Outlook, Yahoo and iCloud. This creates an opportunity for credential theft. A person intending to visit a legitimate service might mistype its address and enter credentials into a site controlled by somebody else.
“Accounts created on look-alike domains are probably the most dangerous because those websites are essentially built to steal credentials,” says Karolis Arbaciauskas, head of product at NordPass and its parent organisation Nord Security, in information provided to Digital Journal.
Arbaciauskas adds that criminals can acquire common misspellings of recognised brands and expired domains and use them for harvesting credentials or intercepting messages.
When a dead domain comes back
Another 2.6 million addresses in the NordPass analysis, equivalent to 4 per cent of the dataset, were associated with domains that had expired, rejected incoming email or had never existed. An expired domain creates an unusual form of residual risk. If another party subsequently registers it, accounts elsewhere on the Internet may still be connected to email addresses using that domain. This is one reason why maintaining accurate recovery addresses matters as part of managing a person’s wider digital identity.
Not every apparently abandoned address presents the same degree of concern. NordPass found around 4.7 million leaked credentials, approximately 7 per cent of the dataset, associated with throwaway inboxes. A further 2.1 per cent used disposable-email services such as YOPmail and Mailinator, which are designed for temporary use. The distinction means that a deliberately disposable mailbox is different from a forgotten address that remains attached to services containing personal or financial information.
The wider zombie-account problem
The phenomenon stretches beyond email. Independent research from Secure Data Recovery illustrates just how common digital abandonment has become. Its survey of 2,493 Americans, conducted in March 2025, examined 94 services and defined zombie accounts as those respondents had not accessed during the previous 12 months. The researchers found that 94 per cent of respondents had zombie accounts.
Pandora topped the survey, with 40 per cent reporting an inactive account, while Groupon came second. Dropbox, Tumblr and Flickr also appeared prominently. Among dating applications, 33 per cent reported an unused Tinder account. Abandoning an application, however, is not the same thing as deleting the account behind it.
This has implications for retailers as consumer behaviour shifts. Recent Measure Protocol behavioural data, for example, recorded a sharp reduction in the US audiences of Temu and Shein following changes to US tariff arrangements. By April 2026, their audiences remained around 30 per cent below their respective pre-change baselines. The findings are based on consented first-party panel data. Reduced usage does not establish how many accounts have been abandoned without deletion, but it demonstrates the wider point: consumers move between services while the digital identities they created can remain behind.
The risk increases when passwords are reused: “These zombie accounts stay online with your email address and password attached, and threat actors treat them as an easy source of data,” says Arbaciauskas.
His warning is particularly pertinent because an old credential may have value beyond the forgotten service itself. A password reused elsewhere can enable criminals to test the same credentials against other accounts.
Previous NordPass research supplied to Digital Journal found substantial password reuse, including among British users, highlighting how compromise of one service can potentially expose credentials reused on another. For organisations, forgotten identities also deserve attention. Previous reporting supplied to Digital Journal has noted the risks created by dormant employee accounts when access is not promptly revoked after people leave or change roles.
NordPass recommends periodically reviewing old registrations and deleting accounts for services that are no longer required. Users should also check whether old email addresses remain linked as recovery addresses and change them where necessary.
Passwords should be unique rather than recycled across services. A password manager can make this more practical, while multi-factor authentication (MFA) adds another protective layer to accounts that support it. NordPass itself lists strong credential policies and integrated two-factor authentication among measures intended to reduce compromised-account risks.
The lesson from the research is ultimately about digital housekeeping. People routinely replace computers, phones and applications, yet their underlying accounts can be much more persistent. Deleting an app removes an icon from a screen. Deleting the account behind it removes something potentially more significant: another forgotten identity that could otherwise remain waiting to be brought back to life.
——————————————————-
Click Here For The Original Source.
