Company Credential

Retailers exposed when employee reuse ID

The retail industry has taken hard hits from cyber attackers over the last several years, thanks to the highly publicized Target and Home Depot hacks along with hundreds of other incidents—there were nearly 160 retail breaches confirmed in the most recent, annual Data Breach Investigations Report from Verizon—the industry accounts for about 14 percent of all lost or stolen data records since 2013, according to an ongoing tally published by BreachLevelIndex.com. Among all sectors, that’s second only to the technology industry.

To lend further insight into the topic, Digital Shadows conducted an analysis of the top 1,000 companies on the Forbes Global 2000 list. With Digital Shadows SearchLight proprietary tool, the company was able to continuously monitor and collect corporate email/password breaches between April 2014 and June 2016 on social media, forums, “dark web” sources, criminal sites and “paste sites.”

Here are some results from businesses in the retail sector:

  • There were an estimated 157,000 unique breached email and password combinations linked to retailers. The personal and household goods subsector accounted for the most (36 percent), followed by apparel (22 percent), food (21 percent) and discount stores (10 percent).
  • Many retail employees and execs re-use their corporate emails for non-business or “unofficial business” outlets such as social media. Therefore, it should come as no surprise that social media sites represented a wealth of the breaches, including LinkedIn (with more than 72,500 occurrences) and MySpace (more than 30,740).
  • Outside of social media, we found nearly 42,000 leaks connected to Adobe and just over 3,200 to iMesh. Ashley Madison and other dating websites served as the source for more than 5,570 leaks—leaks which expose employees’ personally identifiable information (PII), partial credit card numbers and even their sexual preferences.

Why Data Breaches Matter

Our analysis probably comes as good news to cyber criminals, who are eager to leverage credential breaches to target the employees’ organizations. Here are five incidents and trends which illustrate how:

Account takeover. The alleged re-use of passwords stolen during a LinkedIn breach led to a Dropbox attack. Workers neglect to change passwords for years, using them for multiple services, making it too easy for hackers to take advantage.

Spear-phishing. In June 2016, Germany’s Computer Emergency Response Team for federal agencies (known as CERT-Bund) reportedly detected spear phishing emails sent to executives. Threat actors crafted personalized emails using the target’s first name, last name, job role and company name to send malicious, macro-enabled Microsoft Word documents.

Credential-stuffing. This occurs when adversaries automatically inject breached user name and password pairs in order to fraudulently gain access to accounts. The adversaries then hijack the account for a variety of purposes, such as spamming in-boxes, stealing funds and accessing PII.

Post-breach extortion. Hackers collected more than 200,000 corporate email addresses during the 2015 Ashley Madison attack. The cyber criminals then tried to extort victims, threatening to reveal the information to victims’ partners if they didn’t send payments via Bitcoin.

Spam emails. These credentials are valuable for spam campaigns, easily swiping email addresses.

Companies Need a Plan

Enterprises must protect themselves from compromises linked to breached email accounts and passwords. Here are best practices to consider:

  • Develop clearly stated policies to determine which kinds of external services are allowable for corporate email accounts.
  • Deploy an enterprise password management solution for secure storage/sharing and password creation/diversity.
  • Proactively monitor for “credential dumps” relevant to your accounts.
  • Establish multi-factor authentication for external corporate services.
  • Evaluate and document any internal services that aren’t federated for faster and more complete incident response.
  • Implement an emergency password reset process to include all user accounts.
  • Through user behavior analytics tools, import compromised identity information while detecting suspicious activity.
  • Train your employees – and then train them some more.

By fully identifying and mitigating the practices which leave businesses vulnerable—and then investing in employee awareness training—you’ll greatly reduce risk while cultivating a more educated workforce. That’s a win-win proposition in the age of cyber exposure.

This article originally appeared in the May 2017 issue of Security Today.

Featured

  • Pragmatism, Productivity, and the Push for Accountability in 2025-2026

    Every year, the security industry debates whether artificial intelligence is a disruption, an enabler, or a distraction. By 2025, that conversation matured, where AI became a working dimension in physical identity and access management (PIAM) programs. Observations from 2025 highlight this turning point in AI’s role in access control and define how security leaders are being distinguished based on how they apply it. Read Now

  • Report: Cyber Attackers Continue to Turn to AI-Based Tools to Avoid Detection

    Comcast Business recently released its 2025 Cybersecurity Threat Report, a comprehensive analysis of 34.6 billion cybersecurity events detected between June 1,2024 and May 31, 2025. Now in its third year, the report offers business leaders a unique perspective into the evolving threat landscape and provides actionable insights to help organizations strengthen their defenses and align cybersecurity with business risk. Read Now

  • Axis Communications Creates AI-powered Video Surveillance Orchestra

    What if cameras could not only see the world, but interpret it—and respond like orchestra musicians reading sheet music: instantly, precisely, and in perfect harmony? That’s what global network technology leader Axis Communications set to find out. Read Now

  • Just as Expected

    GSX produced a wonderful tradeshow earlier this week. Monday was surprisingly strong in the morning, and the afternoon wasn’t bad at all. That’s Monday’s results and asking attendees to travel on Sunday. Just a quick hint, no one wants to give up their weekend to travel and set up an exhibit booth. I’m just saying. Read Now

    • Industry Events
    • GSX
  • NOLA: The Crescent City

    Twenty years later we finds ourselves in New Orleans. Twenty years ago the aftermath of Hurricane Katrina forced exhibitors and attendees to look elsewhere for tradeshow floor space. Read Now

    • Industry Events
    • GSX

New Products

  • Automatic Systems V07

    Automatic Systems V07

    Automatic Systems, an industry-leading manufacturer of pedestrian and vehicle secure entrance control access systems, is pleased to announce the release of its groundbreaking V07 software. The V07 software update is designed specifically to address cybersecurity concerns and will ensure the integrity and confidentiality of Automatic Systems applications. With the new V07 software, updates will be delivered by means of an encrypted file.

  • ResponderLink

    ResponderLink

    Shooter Detection Systems (SDS), an Alarm.com company and a global leader in gunshot detection solutions, has introduced ResponderLink, a groundbreaking new 911 notification service for gunshot events. ResponderLink completes the circle from detection to 911 notification to first responder awareness, giving law enforcement enhanced situational intelligence they urgently need to save lives. Integrating SDS’s proven gunshot detection system with Noonlight’s SendPolice platform, ResponderLink is the first solution to automatically deliver real-time gunshot detection data to 911 call centers and first responders. When shots are detected, the 911 dispatching center, also known as the Public Safety Answering Point or PSAP, is contacted based on the gunfire location, enabling faster initiation of life-saving emergency protocols.

  • Camden CM-221 Series Switches

    Camden CM-221 Series Switches

    Camden Door Controls is pleased to announce that, in response to soaring customer demand, it has expanded its range of ValueWave™ no-touch switches to include a narrow (slimline) version with manual override. This override button is designed to provide additional assurance that the request to exit switch will open a door, even if the no-touch sensor fails to operate. This new slimline switch also features a heavy gauge stainless steel faceplate, a red/green illuminated light ring, and is IP65 rated, making it ideal for indoor or outdoor use as part of an automatic door or access control system. ValueWave™ no-touch switches are designed for easy installation and trouble-free service in high traffic applications. In addition to this narrow version, the CM-221 & CM-222 Series switches are available in a range of other models with single and double gang heavy-gauge stainless steel faceplates and include illuminated light rings.