Estimating the size of Serie A fanbases using Pwned Passwords

If you have ever wondered which Serie A fanbases are hit the hardest by security breaches, you've come to the right place. If this idea never crossed your mind, that's also very understandable!

Today, I had a bit of fun poking around the Pwned Passwords data dump. I wanted to determine which Serie A team had the biggest fanbase, using the frequency of leaked passwords that can be reasonably associated with a specific team.

For example, forzatoro (3,798) (that's Italian for "go Toro!") is clearly a password we can associate with Torino fans, and it's appeared in a data breach 3,798 times. Throughout this post, I will include several examples of passwords and next to them in parentheses the number of occurrences in Pwnd Passwords.

It's not surprising that passwords attract this sort of content. Despite the best efforts of security experts, people still reach for something they can easily recall and football clubs are extremely memorable for people.

Moreover, they work very well against annoying password requirements. Here's how I imagine it works for someone that's hell bent on using their favorite football club as a password:

Do you need numbers in your passwords? Football clubs have memorable years of foundation or famous dates when they won trophies. If we look at Inter fans whose passwords were pwned, for example, we find inter (23,297), forzainter (21,941), and inter1908 (14,417) in the top three most used passwords. So in my search, I looked for different combinations of club names and foundation year.

I also looked for common combinations of capitalized words, without going too deep in SpOnGEbOb meme territory, this yielded some results, but in general the lowercase versions of each password appeared much more frequently: for instance, forzajuve (15,975), forzaJuve (16), ForzaJuve (65).

I couldn't overlook the obvious so I also searched for the name of the clubs. However, some teams carry the name of their city and some cities are big or famous enough that non-football fans may use their name as a password. For example, napoli (94,331), roma (15,054), or verona (23,381). So I excluded those queries.

Lastly, I manually added some passwords that I knew would return a significant number of hits, for instance, 26maggio (660) for Lazio fans to celebrate their Coppa Italia win against their rivals Roma in 2013 or 5maggio (582) for Juventus fans to celebrate their scudetto against Inter in 2002.

I also included the names of some great players that I thought people would commemorate in their passwords. Here we find delpiero (41,087), maldini (13,979), totti10 (13,425). I notably excluded maradona (74,376) as I don't believe Napoli fans can claim him exclusively for themselves.

A final note about methodology: the Pwnd Passwords dump is about 40GB uncompressed, so to speed up the search I dropped all passwords with fewer than 16 occurrences, which results in a much more manageable 1.5GB text file. Why 16? Because forzasassuolo (17) was the least common password I could find in my manual explorations. You can find the code I ran on GitHub at TommasoAmici/serie-a-passwords.

With all that said, here are the final standings. You can find an extended table with results for each specific password at the bottom of this page.

Extended results