“Xbox and PSP users are going to be a pretty tech savvy bunch with accounts for many different services. As breach after breach has shown that using the same username and password for multiple sites is a bad idea, you would have to imagine this group would have gotten that message by now. When you see a dump of passwords hit a much less techy site, you can be sure that huge numbers of the victims are going to have to go around changing their credentials on the many sites where they foolishly used the same details over and over. If the Xbox and PSP crew haven’t learned that they can’t use the same email and password on every service by now, then likely it is game over for their personal data.”
“Hacks like these are quite common where data has been stolen and the victims are only finding out months or even years later. Scams and phishing attacks will try and use the valuable data to entice even more information from the unsuspecting user; that info is tested, stored and often will be used for identity theft purposes. Quite often people using seemingly low security websites don’t enforce good password security because it’s not a financial target, but all data has a value and will be reused for other purposes. Every website should be treated as unique and require different passwords with a mix of usernames if possible.”
Javvad Malik, IT Security Advocate at AlienVault:
“Gaming forums have been a favoured target in recent months. Typically they have weaker security, so it is easier for attackers to gain access to the passwords. Attackers rely on the fact that most users will reuse the forum password on other sites.
While user education into the dangers of choosing easily-guessed, or re-using passwords should continue, companies need to evaluate all their digital assets equally from a security perspective. There is no such thing as a ‘low priority’ public site wherever a user account resides.
Secondly, these attacks highlight the importance of effective security monitoring controls that can help detect threats underway in a timely manner. In this day and age, discovering a breach over a year after the attack is an eternity.”
Robert Capps, VP of Business Development at NuData Security:
“The recently disclosed data theft from the unofficial PlayStation and Xbox forums is yet another example of the need for consumers to be wary of who they provide their information to, online. While this site is mostly used to distribute pirated copies of games, DVD’s and BluRays, consumers who use the forums need to make sure that they are vigilant. Keep alert to any phishing scams that may appear in email as a result of this hack, changing passwords on any site where the passwords or usernames used on these sites are used. This data is likely to be sold on the Dark Web and used for future cyber crime. It’s a good reminder to choose unique passwords on all sites that require registration.” .
Jeff Hill, Director, Product Management at Prevalent:
“Like rushing to close the barn door after most of the horses have escaped, changing passwords at the time of an announced breach may provide some comfort, but precious little protection. The initial breach occurred in September 2015, giving the attackers 17 months to operate undetected, more than enough time to find and exfiltrate enough data to profit greatly from their efforts. At this point, it’s not even clear the breach was actually detected – possibly the attackers simply rung as much return as possible out of their theft, and simply discarded the remaining useless data. In today’s cybersecurity environment, no metric is even remotely as critical as time-to-detection. Needless to say, 17 months lag time is not a good number.”
“While this breach is minuscule in comparison to the Yahoo breach, the length of time that the victims user name and password combinations were exposed – more than a year – underscores the urgent need for the entire industry to abandon the unsafe and out-of-date use of passwords. Multifactor authentication is hassle free, readily accepted, inexpensive, and provides security that is a magnitude superior.”
“The regularity of data breaches is nearly becoming “white noise” with no context for the significance. Often times the bigger risk picture is lost. The millions of accounts hacked across these gaming platforms is not limited to these platforms, but represents exposure across all online accounts as users commonly re-use the same passwords. Until we move past the use of weak static passwords, they will remain the largest kink in the security armor.”
“This is just the latest example of the relentless pursuit of private data by hackers that gets monetized on the dark web. Any combination of usernames, passwords, email addresses or other private information can be correlated with data stolen from other sources for identity theft and/or data theft. Although this particular incident targeted gaming systems, every large scale breach such as this one should concern businesses as well. Users often use common passwords, security questions, or personal email addresses to access personal and work-related systems, making it easier for hackers to break into corporate networks and steal massive amounts of data.”
Dan Mathews, Director of Sales Engineering at Lastline:
“The forums themselves are isolated from the core Xbox and PSN properties owned by Microsoft and Sony, respectively. The bigger problem with breaches like this is that people frrequently reuse the same username (email address) and passwords at the various sites they visit – oftentimes including sites they visit from their work log-ins.
“This makes it trivial for attackers to compromise multiple sites using user credentials stolen at a single forum, and creates an open channel for advanced and systematic attacks. Lastline’s recommendation: everyone should use a password manager such as Lastpass or Keepass to maintain a master password database, and also to generate high entropy passwords unique to each site that a user maintains a login on. This protects the user, their employer and any third-party entities they touch.”
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Functional
Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes.The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.