Billions of stolen passwords, usernames and other digital credentials are now for sale on the Dark Web. Chances are pretty good that yours are among them.
The Dark Web is a collection of websites that are not indexed by search engines and are highly encrypted, allowing users to remain anonymous. Although some of these sites serve legitimate purposes, many others are illicit marketplaces for drugs, guns and child pornography. However, the sale of stolen digital credentials is far and away the most lucrative criminal enterprise on the Dark Web.
Following an 18-month audit, researchers recently reported that more than 15 billion stolen credentials from roughly 100,000 different data breaches are currently for sale on the Dark Web. With an average asking price of about $15 per record, that represents a potential profit of nearly a quarter of a trillion dollars!
Stolen credentials pose an extraordinary risk for companies. More than 80 percent of all confirmed data breaches can be traced to compromised passwords, according to Verizon’s annual Data Breach Investigations Report.
Beware of DIY Research
Given the risk, many organizations have become increasingly interested in scouring Dark Web sites to see if their data is for sale. In addition, some information security professionals want to poke around just to gain a better understanding of the current threat landscape. While such endeavors might provide valuable intelligence, they can also create legal complications.
The Department of Justice recently issued guidance for companies considering threat research of the Dark Web. While passively collecting information is not illegal, the DOJ warns that activities such as exchanging information with others or using fabricated credentials to gain access to Dark Web forums could create legal liabilities and make the company a target of an investigation.
To reduce risk and liability, companies are better off establishing a relationship with a third-party provider that has the tools and expertise to monitor Dark Web activities safely. Verteks, for example, offers around-the-clock monitoring as part of our managed services offerings. If your sensitive information is ever listed on an illicit website, we can alert you before it is used for criminal activities.
Using a combination of human and artificial intelligence, our service continuously monitors and analyzes millions of chat rooms, peer-to-peer networks, malicious websites, bulletin boards and illegal black-market sites. We notify you immediately if any of your data is discovered.
Mitigating Risk
It’s important to note that this service can’t prevent stolen information from being used, nor can it remove stolen information from the site. However, it does provide real-time awareness of compromised credentials before identity theft or data breaches occur. Armed with that information, we can help you develop a plan for mitigating your risk. That plan might include some of these steps:
- Change passwords. Create new passwords, usernames, PINs and security questions for all accounts.
- Close accounts. Contact the fraud department of credit card companies or financial services organizations and ask them to close or freeze accounts to prevent unauthorized charges.
- Contact credit agencies. Place a free, one-year fraud alert on your accounts. This will require businesses to verify your identity before they can issue new credit in your name.
- Report the theft. File a report at IdentityTheft.gov. This prevents fraudulent charges from appearing on your credit reports and enables a seven-year extended fraud alert with the credit reporting agencies.
- Update and patch. Update software and operating systems with the latest patches and ensure that antivirus and antimalware solutions are up to date.
Compromised digital credentials pose a significant threat to any business. To give you a better understanding of your organization’s risk, Verteks is offering a free Dark Web scan. Just go here to schedule your free search.
