Retailers exposed when employee reuse ID
- By Michael Marriott
- May 01, 2017
The retail industry has taken hard hits from
cyber attackers over the last several years,
thanks to the highly publicized Target and
Home Depot hacks along with hundreds of
other incidents—there were nearly 160 retail
breaches confirmed in the most recent,
annual Data Breach Investigations Report from Verizon—the
industry accounts for about 14 percent of all lost or stolen
data records since 2013, according to an ongoing tally published
by BreachLevelIndex.com. Among all sectors, that’s
second only to the technology industry.
To lend further insight into the topic, Digital Shadows conducted
an analysis of the top 1,000 companies on the Forbes
Global 2000 list. With Digital Shadows SearchLight proprietary
tool, the company was able to continuously monitor and collect
corporate email/password breaches between April 2014 and June
2016 on social media, forums, “dark web” sources, criminal sites
and “paste sites.”
Here are some results from businesses in the retail sector:
- There were an estimated 157,000 unique breached email and
password combinations linked to retailers. The personal and
household goods subsector accounted for the most (36 percent),
followed by apparel (22 percent), food (21 percent) and
discount stores (10 percent).
- Many retail employees and execs re-use their corporate emails
for non-business or “unofficial business” outlets such as social
media. Therefore, it should come as no surprise that social
media sites represented a wealth of the breaches, including
LinkedIn (with more than 72,500 occurrences) and MySpace
(more than 30,740).
- Outside of social media, we found nearly 42,000 leaks connected
to Adobe and just over 3,200 to iMesh. Ashley Madison
and other dating websites served as the source for more
than 5,570 leaks—leaks which expose employees’ personally
identifiable information (PII), partial credit card numbers and
even their sexual preferences.
Why Data Breaches Matter
Our analysis probably comes as good news to cyber criminals,
who are eager to leverage credential breaches to target the employees’
organizations. Here are five incidents and trends which
Account takeover. The alleged re-use of passwords stolen during
a LinkedIn breach led to a Dropbox attack. Workers neglect
to change passwords for years, using them for multiple services,
making it too easy for hackers to take advantage.
Spear-phishing. In June 2016, Germany’s Computer Emergency
Response Team for federal agencies (known as CERT-Bund)
reportedly detected spear phishing emails sent to executives.
Threat actors crafted personalized emails using the target’s first
name, last name, job role and company name to send malicious,
macro-enabled Microsoft Word documents.
Credential-stuffing. This occurs when adversaries automatically
inject breached user name and password pairs in order to
fraudulently gain access to accounts. The adversaries then hijack
the account for a variety of purposes, such as spamming in-boxes,
stealing funds and accessing PII.
Post-breach extortion. Hackers collected more than 200,000
corporate email addresses during the 2015 Ashley Madison attack.
The cyber criminals then tried to extort victims, threatening
to reveal the information to victims’ partners if they didn’t send
payments via Bitcoin.
Spam emails. These credentials are valuable for spam campaigns,
easily swiping email addresses.
Companies Need a Plan
Enterprises must protect themselves from compromises linked to
breached email accounts and passwords. Here are best practices
- Develop clearly stated policies to determine which kinds of
external services are allowable for corporate email accounts.
- Deploy an enterprise password management solution for
secure storage/sharing and password creation/diversity.
- Proactively monitor for “credential dumps” relevant to your
- Establish multi-factor authentication for external corporate
- Evaluate and document any internal services that aren’t federated
for faster and more complete incident response.
- Implement an emergency password reset process to include all
- Through user behavior analytics tools, import compromised
identity information while detecting suspicious activity.
- Train your employees – and then train them some more.
By fully identifying and mitigating the practices which leave
businesses vulnerable—and then investing in employee awareness
training—you’ll greatly reduce risk while cultivating a more educated
workforce. That’s a win-win proposition in the age of cyber
This article originally appeared in the May 2017 issue of Security Today.