It is reported that a data breach broker is selling databases containing user records for 14 different companies he claimed were breached by hackers in 2020. When a company is breached, threat actors will typically download accessible databases, including account records. These databases are then sold directly to other threat actors, or the hackers utilize data breach brokers to sell them on their behalf. Over the past month, a known and reputable data breach broker has been selling numerous databases on hacker forums that they state were acquired in data breaches conducted in 2020.
Experts Comments
July 01, 2020
These databases highlight how far-reaching and insidious data breaches can be. It is possible a company may not even know they were breached when they appear on these lists and yet they become even more vulnerable when they are. These breaches are not just large companies. Anyone can be a victim to a cyber attack and following basic cyber hygiene is especially important for those small businesses without their own IT teams. Utilizing strong passwords and multi-factor authentication, enabling.....Read More
Like(
July 01, 2020
Anyone whose details are included in this database of stolen credentials should obviously reset their passwords as a minimum response. It once again highlights that we need organisations to tackle the problem of malicious actors lurking undetected in their systems for significant periods of time. The sooner suspicious activity is detected, the less time a hacker will have to exfiltrate sensitive information and user credentials. It has become paramount for modern enterprises to accept that.....Read More
June 30, 2020
A data breach occurs. Information is extracted and sold. Potentially compromised data puts companies at risk for litigation, regulatory scrutiny, and reputational damage. Everybody is on edge anticipating the worst while hoping for the best possible outcome, while customers are wary and reticent to give out personal information in the future.
It’s a common pattern with a very simple solution for any organization wanting to improve their security posture—redouble efforts to protect the.....Read More
June 30, 2020
The most telling part of this dump is that 10 out of the 14 companies involved had not disclosed any data breaches prior. Those companies might not have known about the data breaches, or they might have been keeping it a secret. Depending on what country they\'re operating in, they might not be required to publicly disclose data breaches.
Either way, the failure to announce data breaches and inform users before the data is dumped puts all of those users at greater risk of credential stuffing.....Read More
June 30, 2020
The sale of data from data breaches underscores the need for online users to use unique passwords on each and every one of their accounts. Password reuse opens the door to having even a single data breach open the door to having all of a user's accounts violated.
June 30, 2020
It's sad that stories like this, where 100 million user records were leaked, barely make the news these days due to how common they are but that is the world we live it.
It just goes to show that the marketplace for stolen credentials is alive and well despite everything we've done to protect data and disrupt attackers.
June 30, 2020
Details around how and when these breaches occurred are unclear. Many of the 14 companies listed haven't disclosed a breach, so it's difficult to determine the reliability of the data.
However, if the breaches are correct, then this data gives a treasure trove of information to criminals who can use these usernames ad passwords to launch credential-stuffing attacks or use the information to send phishing emails.
It is why it's important that organisations offer 2FA to users, so that if.....Read More
Submit Your Expert Comments
What do you think of the topic? Do you agree with expert(s) or share your expert opinion below.Be part of our growing Information Security Expert Community (1000+), please register here.
Linkedin Message
@Javvad Malik, Security Awareness Advocate, provides expert commentary at @Information Security Buzz.
"Details around how and when these breaches occurred are unclear. ..."
#infosec #cybersecurity #isdots
https://informationsecuritybuzz.com/expert-comments/experts-on-seller-floods-hacker-forum-with-data-stolen-from-14-companies
Facebook Message
@Javvad Malik, Security Awareness Advocate, provides expert commentary at @Information Security Buzz.
"Details around how and when these breaches occurred are unclear. ..."
#infosec #cybersecurity #isdots
https://informationsecuritybuzz.com/expert-comments/experts-on-seller-floods-hacker-forum-with-data-stolen-from-14-companies