Featured in this episode of Tech News of the Week
And here’s the fun part: We have no idea who, nor why.
Breaches, as we all know, happen all the time. The data from them is sold when it can be, but eventually it all gets made public. It’s still a pain to collate them all, but sites like haveibeenpwned and Cybernews do it all the time. That way you can do one search and simply marvel at all the different companies that have lost your PII. I just checked mine, and it’s up to at least 41. Including, ironically, my credentials on a training website called pii-protect.com. FUN!
This week, security researchers from Cybernews and SecurityDiscovery announced what they’re calling the Mother of All Breaches, or MOAB. This contains 26 billion records from nearly 4,000 breaches. This is obviously the largest single collected trove of breach data ever found by a mile. It’s not that any of this is new (but it might be), it’s really just that it’s all in one place. It was found on “an open instance” just, like, sitting there. Super vague I know, but it’s the Dark Web. I think they still use telnet.
So: bright side? All the good guys have this list and will be doing scanning on your behalf to see if you have credentials that are in a breach. And you have a lot of good guys trying to help- you can enable it in Microsoft 365, your password manager probably, basically any IAM platform worth its salt. The bad news? All the bad guys have it too.
As always the username and password can only get the bad guys so far. Don’t reuse passwords, use MFA, answers to security questions should be random, disable accounts that are no longer used, etc, etc. Basic online security hygiene is just not going to go out of style.