You may have read about the recent attack affecting motoring powerhouse General Motors (GM), that resulted in significant numbers of GM’s customers having their accounts compromised. Wedding planning company Zola was also impacted by a similar attack in the same week of May 2022, with the attackers using the compromised accounts to redeem gift cards. […]
In 2020, our research report on account takeover (ATO) highlighted the risk of using credentials in an unsafe manner, which was being exploited by cyber threat actors to great effect. In the coming weeks, we will be issuing our follow on report on ATO, which found that many of the problems surrounding credential use remain; […]
Note: This blog is taken from our recently published Exposed Credentials Solutions Guide, which includes a complete list of our mitigation strategies and free resources to begin monitoring for exposed credentials. Preventing an account takeover (ATO) or data breach through compromised credentials has never been a small job nor easy job. Unfortunately for security teams, […]
Rumour has it that one day I’ll stop being nostalgic around December time and live this month just like any other month. But that day is not today. That’s why we are here to go through the top five blogs of 2020—one for each quarter plus a bonus one to quickly recap why they (still) […]
Reward program fraud has been rising in recent years across the aviation industry as well as the entire transportation sector. Some experts theorize that because Europay, Mastercard and Visa (EMV) chip technology has made physical credit card fraud more difficult, it has instead led to the global rise of reward point theft. A major airline […]
Despite some early deals, Black Friday officially begins on 24th November, kick-starting over a month of consumer spending over the holiday period. This year, it’s expected that a whopping $862 billion dollars will be spent during this season. A significant chunk of this is online sales, with $116 billion set to be spent. Cybercriminals also look […]
A guest blog from Bitglass, read the original at https://www.bitglass.com/blog/datawatch-beware-of-careless-insiders Every day, employees around the world use the cloud to perform their jobs. With bring your own device (BYOD), workers are given dynamic data access to complete their work from unmanaged devices, remote locations, and unsafe WiFi. Due to the host of modern cloud applications, corporate […]
In May 2017, an amalgamation of over 1 billion credentials was uploaded to the Have I Been Pwned database. One of the lists has been dubbed “Anti-Public”, and contained 457,962,538 unique email addresses. This list has reportedly previously been widely circulated and used for credential stuffing attacks, whereby attackers seek to identify instances of password […]
In our first blog, we outlined a number of specific factors that can be used to determine a dataset’s desirability, from the perspective of a malicious cyber actor. This second blog looks at the specific ways that threat actors are using this data – referred to as industrialization – and how these factors of desirability […]