Data of over 1.1 mn customers stolen at 17 well-known firms

More than 1.1 million online accounts compromised in cyberattacks at 17 well-known companies, announced Attorney General James.

Without revealing the names James released a “Business Guide for Credential Stuffing Attacks” that details the attacks — which involve repeated, automated attempts to access online accounts using usernames and passwords stolen from other online services — and how business can protect themselves.

Credential stuffing has quickly become one of the top attack vectors online. Virtually every website and app use passwords as a means of authenticating its users. Unfortunately, users tend to reuse the same passwords across multiple online services. This allows cybercriminals to use passwords stolen from one company for other online accounts. Following discovery of the attacks, the Office of the Attorney General (OAG) alerted the relevant companies so that passwords could be reset, and consumers could be notified.

“Right now, there are more than 15 billion stolen credentials being circulated across the internet, as users’ personal information stand in jeopardy,” said Attorney General James. “Businesses have the responsibility to take appropriate action to protect their customers’ online accounts and this guide lays out critical safeguards companies can use in the fight against credential stuffing. We must do everything we can to protect consumers’ personal information and their privacy.”

What is Credential Stuffing?

Credential stuffing is a type of cyberattack that involves attempts to log in to online accounts using username and passwords stolen from other, unrelated online services. It relies on the widespread practice of reusing passwords as, chances are, a password used on one website was also used on another. 

In a typical credential stuffing attack, an attacker may submit hundreds of thousands, or even millions, of login attempts using automated, credential-stuffing software and lists of stolen credentials downloaded from the dark web or hacking forums. Although only a small percentage of these attempts will succeed, through the sheer volume of login attempts, a single attack can nevertheless yield thousands of compromised accounts.   

An attacker that gains access to an account can use it in any number of ways. The attacker can, for example, view personal information associated with the account, including a name, an address, and past purchases, and use this information in a phishing attack. If the account has a stored credit card or gift card, the attacker may be able to make fraudulent purchases. Or the attacker could simply sell the login credentials to another individual on the dark web.

Credential stuffing is one of the most common forms of cyberattack. The operator of one large content delivery network reported that it witnessed more than193 billion such attacks in 2020 alone.

The OAG alerted each of the 17 companies to the compromised accounts and urged the companies to investigate and take immediate steps to protect impacted customers. Every company did so. The companies’ investigations revealed that most of the attacks had not previously been detected.