Millions at risk as new study highlights unused Zombie accounts which could be exploited by criminals — here’s how to stay safe

• Most people forget their old accounts, but criminals never forget how to exploit them, report warns
• Zombie accounts are digital weak spots just waiting for password reuse to ruin everything
• Platforms like Groupon and Pandora are packed with logins that no one’s watching anymore

Forgotten accounts for apps you no longer use might not seem like your most pressing security concern, but new research has claimed they can be far more than digital clutter.

A study by Secure Data Recovery found 94% of respondents admitted to having one or more zombie accounts – accounts left unused for at least 12 months.

These neglected profiles often remain active and vulnerable, giving cybercriminals a quiet back door into users’ digital lives.

Pandora, Groupon, and Shutterfly lead the list of forgotten services

Pandora tops the list of abandoned services, with 40% of respondents admitting they still have unused accounts, with Groupon and Shutterfly following closely, reflecting a wider trend of users drifting away from once-popular platforms.

“That account you haven’t logged into for over a year? It’s still there,” the study notes, warning that abandoned profiles are ripe for hijacking.

These unused accounts aren’t limited to music or shopping, as photo-sharing platforms like Dropbox, Tumblr, and Flickr are also frequently forgotten – and the trend even extends to more sensitive categories, with dating apps such as Tinder, OkCupid, and Bumble ranking highest in abandonment. In the financial space, Acorns, Mint, and YNAB are often left idle, despite potential access to personal or financial information.

Many users simply forget these accounts exist, assuming that inactivity means deletion. In other cases, disinterest drives abandonment.

Facebook ranks highest in dissatisfaction, followed by Twitter/X and Amazon Prime Video. Some platforms failed to keep up with expectations, while others, like Prime Video, alienated users by adding ads.

Interestingly, Prime Video also appears on the list of most-missed services, suggesting users are divided in their views.

The consequences of ignoring these accounts go well beyond clutter.

Reusing passwords across sites, especially between zombie accounts and work or banking logins, creates serious risk.

Secure Data Recovery warns: “Having the same login for that eight-year-old Tumblr account and your active work email might not be in your best interest.”

How to stay safe

• To reduce risk, review the services you’ve signed up for – if you no longer use an app or website, delete the account.
• Never reuse passwords. A compromised old account using the same login as your current one can put your data at risk.
• Create strong, unique passwords for every account. A password manager can help you keep track of them.
• Also, check the privacy settings on accounts you still use. Some may be sharing more than you think. Adjust those settings to limit how much information is visible.
• Whenever possible, enable two-factor authentication for extra protection.
• Finally, use antivirus tools, especially on Android phones.
• A good free antivirus can warn you about unsafe apps and detect if your device has been compromised.

You might also like

• These are the best ransomware protection tools to keep you safe
• Nail the basics with the best firewalls available now
• McDonald’s AI recruiting platform had a really embarrassing security flaw