The average consumer has more passwords and accounts than anyone can remember. In most cases, consumers are reusing those passwords across services, and those services are allowing the use of passwords that have previously appeared in breaches. Second, the relative ease of a threat actor to compromise multiple services based on a single password produces problems for consumers, as not all websites will have rapid consumer notifications.