Shared credentials are valid usernames, passwords, tokens, or keys that are reused by more than one person, system, or service. Because the same login can open multiple accounts or devices, a single leak, phishing hit, or malware dump can give an attacker repeated access without needing to break anything else.
They matter in cyber security because they widen blast radius and weaken accountability. In attacks, stolen shared logins often let intruders move through mailboxes, remote access portals, cloud consoles, or third-party services. In defense, teams reduce risk by removing shared accounts, assigning unique identities, using multi-factor authentication, rotating secrets, and monitoring for reuse across systems. When a public victim listing appears, shared credentials are one of the access paths investigators should check, but they must verify that reuse actually occurred.