Ai Editorial: Why even one data breach today is enough to shake a consumer?

First Published on 4^th December, 2018

Imagine receiving an email early in the morning, stating that your personal data has “possibly” been compromised. It’s disturbing. But the agony doesn’t end here. Ai’s Ritesh Gupta explains why.  

A data breach is a big concern for all. From consumers’ perspective, if one understand the tricky situation it can shake one and all. Come to think of it - if a user has created a formidable password and believes everything is fine, how about unearthing the fact that if there is a data breach, then the same password is leaked and is of no use. Considering what all is at stake, the leaking of passwords and how a fraudster can benefit from it is an annoying as well as distressing situation for the user.  

As experienced from an email from Quora today, the company shared that some user data was “compromised by a third party who gained unauthorized access” to its systems. Information that may or may not have been compromised includes account and user information (e.g. name, email, IP, user ID, encrypted password, user account settings, personalization data). Even though the company acknowledged that it is their responsibility to make sure things like this don’t happen, it also stated: “while the passwords were encrypted (hashed with a salt that varies for each user), it is generally a best practice not to reuse the same password across multiple services, and we recommend that people change their passwords if they are doing so”.

A massive problem for consumers

The agony prolongs after this email. The thought of using one password for multiple accounts haunts. 

A frail approach towards password management is enabling hackers to gain access to confidential information.

As per an analysis, initiated by password management specialist LogMeIn’s LastPass, nothing much has changed over the last two years when it comes to choosing and handling of passwords.

As we highlighted in one of our reports, consumers stick to same passwords and don’t change them often. This is a significant revelation as password stealing means all account-based online services are under a threat.

In an interview, an executive from Sift Science even pointed out that every one’s credentials have already been compromised and the industry has actually reached the point of no return. It might not be a straightforward task to gain access to everyone’s account, but just like solving a puzzle or putting several pieces together, fraudsters can sneak through the defence. So from one data beach one can get a vital piece of information about users. And then another breach sharing more details about users and so eventually cracking all details of one account.

This issue of same password for multiple accounts is a tough habit to break. Even the millennials, a group supposedly well-versed with technology, mostly reuse passwords because of fear of forgetting and commonly use a variation of 1-2 passwords they can remember! On the positive side, more users are opting for more secure password storage and automated password resets to overcome the anxiety of failing to recall, but it is a long way to go.

How to go about it?

Even as credentials are being stolen, it is imperative for organizations to bolster the authentication process. Merchants should aim to mitigate the damage done by ensuring that the stolen data cannot be used. One way to achieve this is to deploy real-time active surveillance on every login to filter out potential threats and prevent attackers from gaining unauthorized access to accounts. Organizations can avail offerings that can spot passwords that are currently in use in a domain but have been exposed in a previous data breach. As much as merchants need to take action and ensure that data doesn’t get stolen (How to prevent “Starwood guest database breach” -like incidents?), consumers, too, need to be informed.

So inform and educate customers about the significance of passwords. There might not be anything new in these instructions but nevertheless the importance of strong passwords and changing them from time to time can help. For instance, working out unique passwords that include a sequence of upper and lowercase letters, numbers and special characters. Directing users not re-use same passwords. Train the user to be security-minded and to spot scams. Also, as in case of certain apps, the password expires after a while and users are left with no option but to change it. No one likes friction in any user session, but at the end of the day the problem is too big to ignore.

Follow Ai on Twitter: @Ai_Connects_Us