21 Million stolen credentials from Fortune 500 companies available on the dark web

By Pierluigi Paganini for Security Affairs
Thursday, October 31, 2019

• 2.2k
• 8
• 8
• 8
• 4
• More
• 8
• 8
• 8

Another interesting data emerged from the report, on average, 11% of the stolen passwords from one breach are identical pointing out to usage of default passwords, proliferation of [spam & data scraping] bots creating accounts, or a previous password reset setting an identical password to a large set of accounts.

“These numbers are both frustrating and alarming. Cybercriminals are smart and pragmatic, they focus on the shortest, cheapest and safest way to get your crown jewels. The great wealth of stolen credentials accessible on the Dark Web is a modern-day Klondike for mushrooming threat actors who don’t even need to invest in expensive 0day or time-consuming APTs.” concludes Ilia Kolochenko, CEO and Founder of ImmuniWeb.

“With some persistence, they easily break-in being unnoticed by security systems and grab what they want. Worse, many such intrusions are technically uninvestigable due to lack of logs or control over the breached [third-party] systems.” Read Full Article