But it's okay because it's just our Cloudflare free accounts!

As usual, if you're using a company's services for free, you're not the customer, you're the product being sold.

Scope of the analysis

Our data analysis focuses on traffic from Internet properties on Cloudflare’s free plan, which includes leaked credentials detection as a built-in feature. Leaked credentials refer to usernames and passwords exposed in known data breaches or credential dumps — for this analysis, our focus is specifically on leaked passwords. With 30 million Internet properties, comprising some 20% of the web, behind Cloudflare, this analysis provides significant insights. The data primarily reflects trends observed after the detection system was launched during Birthday Week in September 2024.

https://blog.cloudflare.com/password-reuse-rampant-half-user-logins-compromised/#scope-of-the-analysis

@0xF21D @malanalysis