The state of stolen credentials on the Dark Web
Every time there's a major data breach it adds to the pool of stolen details available on the Dark Web, but exactly what is out there?
To find out, ImmuniWeb has been analyzing the quality and quantity of stolen credentials accessible on the Dark Web originating from Fortune 500 companies in 10 different industries around the world.
The technology sector has, perhaps not surprisingly, the most stolen credentials out there at just over five million. Financial businesses are just behind at just under five million, there's then a big drop to healthcare in third place with only 1.9 million sets of exposed credentials on offer. Retail is surprisingly low with just 682,408.
Among the 21 million records analyzed there were only 4.9 million fully unique passwords, which suggests there's still some way to go in educating people on password use. Weak passwords are most prevalent in the retail sector, with 47.9 percent being either eight characters or less, found in common dictionaries, or unchanged from the default. Technology and healthcare do better here, with weak passwords at 33.87 and 33.47 percent respectively.
In addition, around 42 percent of the stolen passwords analyzed are somehow related either to the victim's company name or to the breached resource in question, making password brute force attacks highly efficient.
"These numbers are both frustrating and alarming," says Ilia Kolochenko, CEO and founder of ImmuniWeb. "Cybercriminals are smart and pragmatic, they focus on the shortest, cheapest and safest way to get your crown jewels. The great wealth of stolen credentials accessible on the Dark Web is a modern-day Klondike for mushrooming threat actors who don't even need to invest in expensive zero-day or time-consuming APTs. With some persistence, they easily break-in being unnoticed by security systems and grab what they want. Worse, many such intrusions are technically uninvestigable due to lack of logs or control over the breached (third-party) systems."
You can read more about the results on the ImmuniWeb blog.
Image credit: rimom / Shutterstock