How Compromised Passwords Lead to Data Breaches

As cyberattacks continue to rise, compromised passwords remain to be the root problem

When you think of data breaches, it often conjures images of a hacker fervently typing away to crack a company’s systems. While sometimes hackers do find vulnerabilities in systems and break in that way, it isn’t the most common cause of data breaches. Not even close.

80% of data breaches are the result of compromised login credentials. These data breach statistics are laid out in Verizon’s Data Breach Investigations Report. According to this report, most data breaches are due to compromised passwords.

How are passwords compromised though, and how can this lead to a data breach?

How passwords are compromised

There are a few different ways that cybercriminals can obtain login credentials. Let’s touch on three of the most common.

Phishing attacks

Phishing attacks are the most common method used by cybercriminals to steal passwords. When hackers carry out phishing attacks, they typically send emails out and pretend to be a company or individual that you’ve done business with before.

For example, a user may receive an email that looks like genuine communication from your organization's IT department. This email may inform the user that their password needs to be reset for security purposes with a conveniently provided link to do just that. This link leads to a scam website, where the user enters their credentials and suddenly their account is compromised.

Phishing attacks can be targeted at any type of business, but statistics show they are most prevalent in the financial industry with just under a quarter of all phishing attacks occurring in finance.

Malware

Malware is malicious software that is installed on a user's system or a web server. Some of this malware is designed specifically to steal passwords. This can be accomplished in several ways, depending on the specific malware that is used.

For one, if a user gets into the habit of storing passwords using the web browser’s autosave feature, then you’re in danger of having all those passwords stolen. That’s because certain malware can take over the web browser and get into the settings to extract these passwords.

One of the biggest malware threats to a business is ransomware. Ransomware is a type of malware designed to steal or deny data access from a business unless a ransom is paid. One of the most common ways for hackers to deploy ransomware is by accessing business systems through compromised passwords.

Other malware may include key loggers. A key logger is software that records every keystroke of a user's keyboard. So, when the user goes to log in to an online account, the key logger can pick up the user id and password as they are being typed.

Data breaches from compromised passwords

Compromised credentials can of course be a nightmare for individuals. If an employee's credentials are stolen, it could lead to a massive data breach that leaks all of your customers' private information. Even big tech companies are not immune to these breaches, as we saw with the infamous Yahoo data breach in 2013 that resulted in over three billion accounts being hacked.

The new pandemic-driven remote working environments that are commonly found today can open up additional risk. One in five employees claims they've been a victim of identity theft, with 60% of them saying they are stressed about their finances. What's worse, nearly 25% of fraud victims had unreimbursed personal expenses. This was around three times higher than just a few years earlier. This information—along with other useful details about identity and privacy protection—can be found in IDX's whitepaper Financial Wellness + Identity & Privacy Protection: A Winning Formula.

As damaging as a breach is for an individual, it can be even more devastating for a business. And this happens when privileged credentials are stolen, such as the password of an employee who has high-level access to a company’s systems. In these instances, one compromised password can lead to the leak of the private data of thousands of customers.

This risk is why privileged access management and identity governance are a critical part of any cybersecurity plan.

Tips to share with your employees

There is no 100% effective method to prevent data breaches. Cybercriminals are constantly finding new ways to gain access to systems. However, there are steps you can take to make it far more difficult, keep yourself as protected as possible, and mitigate data breaches. Whether you have on-site, remote, or hybrid employees, it would be beneficial to share the following tips with them to keep their credentials safe.

Use password managers

Reusing passwords is a big problem. This is a major issue because if there is a data breach where login information for one website is leaked, a user is highly susceptible to other accounts being accessed with the same information. Cybercriminals can programmatically try leaked login information across thousands of websites to see if any others can be accessed.

To avoid this, your business can use a password manager such as the one included in IDX Privacy. A password manager generates random, highly-complex passwords for each of your individual accounts. Remembering all those random passwords is impossible though, so you’ll have one complex master password to remember. As long as you can memorize this one single password, you can log in to any of your accounts.

Multi-Factor authentication

Passwords alone aren’t a particularly secure authentication method. Even complex passwords could be cracked with enough time and ingenuity from hackers. That’s why multi-factor authentication (MFA) is becoming standard for most online accounts and can help reduce the impact of compromised passwords.

With MFA, you will need to authenticate your account using a second method other than a password. In most cases, you’ll need to receive a text message or email with an authentication code when you try to log in. This authentication code is only valid for a brief time—typically 5 minutes or less—so the risks of stolen codes are minimized.

As a business, it would be a wise decision to require employees to use MFA for any business system logins.

Invest in identity theft protection

A solution like IDX Identity can help mitigate identity theft concerns. With IDX Identity you'll get a bevy of identity theft protection features including:

• Cyberscan Dark Web Monitoring
• Credit Monitoring
• SocialSentry Social Media Privacy and Fraud Protection
• Password Detective
• ForgetMe Data Removal

To mitigate security risks, the best approach is to adopt proactive solutions. IDX aims to fight against the dangerous realities of ID theft for employees with its platform.

There is never a guaranteed way to prevent identity theft, but IDX Identity can add a layer of protection to help you catch potential identity theft right away and make the recovery process easier. This is a great benefit to provide to employees to protect both them and your business.

Protect Private Information

Compromised passwords are the cause of most data breaches. Whether these are obtained through phishing attacks, malware, or simple mishandling of passwords, the results can be devastating.

It’s important for companies to help protect their employee’s private information. This includes both company data as well as helping to curtail instances of identity theft. IDX has solutions that can help protect your company and your employees. Contact us today to get started with an industry-leading privacy & identity theft protection platform.