One stolen credential is all it takes to compromise everything