Countdown to Ruin: Hacked Data Goes Public in As Little as Nine Minutes

How quickly do you think you can cancel your credit card in the event of a hack? In the time it takes you to reach the automated number and enter the right sequence of numbers and options, it may be too late.

Image: Max Pixel

According to a new alert from US-CERT (the Computer Emergency Readiness Team of the U.S Department of Homeland Security), nine minutes is all it takes for your compromised personal information to be widely accessible and for sale to the hacker universe, and for criminals to start trying to use your stolen information. If that information includes usernames and passwords that you use for multiple sites, are you confident that you could change the passwords to all those sites in under nine minutes? Chances are, you won’t even know your information has been hacked in the first nine minutes following the hack.

Your personal information, once hacked, is typically posted online in hacker forums and paste sites such as Pastebin. There, the data is quickly accessed by other criminals in as little as nine minutes, according to FTC researchers who conducted an experiment to track attempts to use stolen information.

Your account information by itself may be worth as little as $2, but it may be very valuable to criminals who can exploit the stolen information while it is still valid. And your information might be packaged with other compromised information in baskets of stolen data for sale – like an Amazon or eBay for hacked data – but accessible to criminals using specialized browsers such as Tor.

To mitigate the risk of identity theft, the FTC recommends using multi-factor authentication where feasible. Passwords are a typical form of single-factor authentication. Multi-factor authentication requires one or more additional pieces of information, such as a PIN or one-time code, to verify your identity. This also makes it more difficult for someone who has stolen your username and password to monetize or use that information effectively – because they do not have all the necessary pieces to be able to get into your account.

Related Content

Latest Content

OCIE Examined 15% of RIAs in 2017

In 2017, the SEC examined 2,114 investment advisers, approximately 15 percent of the 14,000+ registered investment advisers, the SEC confirmed in its Fiscal Year 2019 Congressional Budget Justification Annual Performance Plan. In the same report, the SEC said the staff will continue to improve its efforts of RIAs, noting that nearly 35 percent of all … Continued

Ascendant’s Adam DiPaolo Discusses Hypothetical & Model Performance Marketing Pitfalls

A Jan. 12 article in HFMCompliance titled “Best practice for hedge funds using hypothetical and model performance” outlines best practices for hedge fund managers when using hypothetical performance or model data in marketing efforts, and how managers relying on such data can avoid enforcement actions. Adam DiPaolo, Senior Consultant in Ascendant’s Private Funds group, is quoted in the … Continued

SEC’s Exam Priorities Offer Insight Into National Exam Program

On February 7, 2018, the SEC’s Office of Compliance Inspections and Examinations (“OCIE”) issued their 2018 Examination Priorities (see Ascendant’s summary here). In addition to defining their examination priorities for the year, the OCIE staff offered some insight into the National Exam Program.  Specifically, they defined the following five principles in executing their exam priorities: … Continued

SEC Updates: ICO Gatekeeper Standards, SEC/CFTC Swap Rules

SEC Chairman Jay Clayton had some stern advice for market professionals, especially gatekeepers, who he said need to act responsibly and hold themselves to high standards. Speaking via videoconference during Securities Regulation Institute’s recent annual conference, he said, “To be blunt, from what I have seen recently, particularly in the initial coin offering (“ICO”) space, they … Continued

Mailing List

Subscribe to the Ascendant Compliance email list for the latest compliance resources, conferences, ComplianceCasts™, and more.

Loading form...

Contact Us

Ascendant works together with clients to identify and assess critical needs through customized plans. If you need assistance with compliance functions, regulatory services, cybersecurity or technology tools, we’d love to speak with you.