Stolen or compromised credentials as attack vector amount to 19% of data breaches, according to research by IBM’s Cost of a data breach report and the 2021 data breach report by ITRC reveals that cyberattacks, including credential stuffing, made up 88% of data breaches in Q3 of 2022. Most cyberattacks on businesses and organizations happen because a threat actor accessed a user’s stolen credentials. An organization is only as vulnerable as a stolen credential, regardless of the physical security, the 3G’s (Guards, gates and guns), or how big the cybersecurity budget is. Password thefts have been a thing since computer exists and have seen exponential growth with the expanding threat landscape. More forums and marketplaces on the deep and dark web sell stolen and leaked credentials that can be used to gain the initial access into an organization’s IT environment.
Let’s look at the concept of “Identity Theft” and the ways to prevent it.
For cybercriminals, the least resisted access is always the best, as threat actors would target low-hanging fruits and easy attack vectors to gain access and engage in nefarious activities.
What is Identity Theft?
Identity theft is when someone steals a user’s personal information, like social security number, password, credit card details, date of birth, etc., to impersonate or commit crimes. During the Covid19 pandemic, threat actors took advantage by impersonating US citizens to access targeted relief checks and unemployment benefits. The FTC (Federal Trade Commission) received over 1 million identity theft complaints in 2020, which is why organizations and individuals must take Identity theft prevention seriously.
Identity theft can be used to steal money from a user account, access services a user has been privileged to have or open a new credit line, or steal a tax refund. This is not limited to individuals, as it has become prevalent on social media platforms; friends, co-workers, and bosses are frequent victims of identity theft.
Consequently, password theft is widespread in data breaches today. Verizon’s 2022 Data Breach Investigations Report states that weak or stolen credentials may be to blame for 81% of hacking-related breaches. Data breaches also mean your information and credentials might be exposed and up for sale on the deep and dark web.
How Identity and Password Theft HappenÂ
The ways cybercriminals steal victims’ credentials and identities are inexhaustible, but here are a few popular ones:
- Using Public WIFI: Public WIFI, especially at airports, Café, events or anywhere to catch up on a favourite show or check our mailbox seems rather convenient. However, using a public WIFI for shopping, banking and logging into work resources can be dangerous without a VPN.
- Malware: Visiting a malicious website or downloading a malicious attachment can install malware with keylogging capacities that record every keystroke from the keyboard and share it with the attacker.
- Shoulder surfing: This is a typical occurrence in workplaces, ATM locations, public spaces, etc. Shoulder surfing happens when someone peeks over a user’s shoulder to capture username, password, ATM pin, or credit card information.
- Phishing is another typical technique cybercriminals employ to get victims’ passwords. Cybercriminals use the data they steal from phishing attacks to conduct criminal operations while posing as victims. To deceive their unwary victims into divulging their passwords, social security numbers, credit card information, pins, and other confidential information, they send emails pretending to be organizations of their victims.
- Cyber breach: Organizations are breached regularly, and credentials and private information of employees, customers, and clients are stolen. These credentials and data mostly find their way to paste sites as dumps or on the dark web and forums for other cybercriminals to use. Many credentials on the dark web and forums are also available for free download to other cybercriminals.
How to Prevent Identity and Password Theft
- Enable Multi-Factor Authentication on all accounts
- Avoid password reuse on critical accounts
- Be mindful when typing login credentials in public
- Create unique and strong passwords for all accounts
- Never write down your passwords on paper
- Always shred papers or documents that contain sensitive information
- Keep valuables, like credit cards and identity cards, to avoid getting into the wrong hands.
- Never enter private information when connected to public WiFi. Check your account bills frequently for unauthorized purchases, transfers, and bills. Regularly check your account bills for unauthorized purchases, transfers, and bills.
Conclusion
There are some areas we cannot fully control, like data breaches, but should you suspect that your identity is being stolen or used; one step to take is reporting to Identitytheft.gov, which FTC runs. Federal Trade Commission is a one-stop shop for information and reporting around Identity theft. Reporting Identity theft usually starts with an investigation and the restoration process depending on the type of identity theft.
Another option is to try out Identity protection services, which can give visibility into the information that has been used or might be at risk or found dumps or for sale on dark web forums.
