.png)
23andMe User Data Stolen in Credential Stuffing Attack
23andMe confirmed customer data was exposed via credential stuffing and the DNA Relatives feature. We explain how it happened and how to secure your account and check for breached credentials.
PetSmart Warns Customers of Credential Stuffing Attack
%20(1).png)
Introduction
PetSmart, a pet retail giant in the United States, is alerting certain customers about password resets resulting from an ongoing credential stuffing attack attempting to breach existing accounts. The company released a statement on March 6 to let customers know about the credential stuffing attack.
As a precaution, PetSmart reset the passwords for any accounts logged in during the credential stuffing attack. Additionally, they reassured customers that there was no evidence of compromise to petsmart.com or any of their systems during the incident.
What is credential stuffing?
A credential stuffing attack is a type of cyber-attack in which threat actors use previously acquired usernames and passwords, typically obtained from data breaches, to gain unauthorized access to user accounts on various online platforms.
Threat actors usually automate the process of trying these login credentials across multiple websites and services. Threat actors are cognizant of the fact that people commonly reuse passwords across various accounts, making them even more inclined to exploit this widespread behavior.
How to protect yourself against credential stuffing attacks
Although cyber breaches may be unavoidable, you can still prevent breached details from being used on other websites or services by taking the following precautions:
- Use Unique Passwords For Each Account – Minimize the impact if one account is compromised.
- Enable Multi-Factor Authentication (MFA) – Implement MFA wherever possible to add an additional layer of security.
- Update Outdated Passwords – Change your passwords periodically, especially for critical accounts like email, banking, and social media.
- Limit Access – Only use trusted devices and networks to access sensitive accounts. Avoid logging in from public computers or unsecured Wi-Fi networks to access sensitive accounts. Ensure that you are not saving your credentials on a public computer.
Ready to stay protected from digital threats, with experienced professionals overseeing your security?
Request a private consultation to find out whether Richter Guardian is a good fit for you.
Share this post
Security advisories
Protect your digital life by detecting risks before they escalate
Richter Guardian gives you enterprise-level cybersecurity tailored for individuals, families, and executives.
24/7 monitoring & threat intelligence
Identity theft & impersonation detection
Fast incident recovery & expert guidance
Blog
Related posts
Introduction
The public biotechnology and genomics firm, 23andMe, confirmed on their website on October 6, 2023, that certain 23andMe customer profile information was circulating on hacker forms. The information that has been exposed from this incident includes full names, usernames, profile photos, sex, date of birth, genetic ancestry results, and geographical location. As a result, 23andMe have notified their customers, and have pushed for them to reset their passwords and enable multi-factor authentication (MFA).
How the attack happened
The hackers used credential stuffing to gain access to a set of user accounts on 23andMe. Credential stuffing is a type of cyber attack in which a hacker uses stolen usernames and passwords (obtained from another breach or purchased off the dark web) to access other websites in which the users are registered. Users that recycled their breached login credentials on 23andMe may have been the entry point for this attack.
A subset of the compromised users opted into 23andMe’s DNA Relatives feature, which allowed for hackers to scrape the data of their DNA Relative matches.
The number of accounts affected has not been released or disclosed by 23andMe.
If you think you may have been affected by this recent breach, reset your password, and opt for MFA on 23andMe. While the account may or may not be compromised, it is important that cybercriminals do not leverage your breached credentials to access other websites in which you may have an account on.
How to stay safe
- Reset All Passwords – If you have the bad habit of reusing passwords across different websites, reset those passwords and employ hard-to-guess, complex passwords on those websites.
- Password Manager – To keep track of your complicated passwords, think about investing in a password manager. Password managers, like 1Password, place a secret key on your password manager to add a unique extra layer of security.
Richter Guardian can help you determine if some of your user accounts were involved in a previous breach. Our platform can determine compromised credentials through comprehensive dark web monitoring.
Sources
- “Addressing Data Security Concerns”. 23andMe. 2023 October 6. Retrieved 10 October 2023.
Ready to stay protected from digital threats, with experienced professionals overseeing your security?
Request a private consultation to find out whether Richter Guardian is a good fit for you.
Why Authenticator Apps Are Safer Than SMS for Login Security
Authenticator apps are more secure than SMS for two-factor authentication. We compare both methods, explain SIM swapping and interception risks, and recommend using an authenticator app for important accounts.
Introduction
One of the best ways to add extra security to your accounts is through Multi-Factor Authentication (MFA) – this means you need more than just a user ID and password to log in. We strongly recommend using MFA for your important accounts.
However, not all MFA methods are equally secure. Authenticator apps are a safer option than SMS authentication methods because they generate security codes directly on your device. SMS authentication codes, on the other hand, can be intercepted by hackers.
What is Multi-Factor Authentication and what is the benefit?
MFA adds an extra step to logging in. Instead of just entering a user ID and password, you must also provide another piece of information, like a code from an app or a text message. This extra step makes it much harder for hackers to break into your account, even if they steal your password.
MFA method #1: What is an authenticator application?
An authenticator app is a mobile app that generates security codes for logging in. These codes are called Time-Based One-Time Passwords (TOTP) and change every 30 to 60 seconds.
When you set up an authenticator app for an account, you scan a QR code or enter a secret key. This links the authenticator app to your account and allows it to generate matching codes.
To log in, you enter your username, password, and the current code displayed on your authenticator app. If the code matches the one your account server expects, you get access.
Some popular authenticator applications include:
- Google Authenticator
- Microsoft Authenticator
- Authy
- Duo Mobile
MFA method #2: What is SMS authentication?
SMS authentication is when a security code is sent to your phone via text message. You enter this code along with your user ID and password to log in. These codes are One-Time Passwords (OTP) which are generated for one-time use. OTPs can last for a specified amount of time – users will need to generate a new OTP if they exceed the time limit.
Sometimes, websites may also send security codes via email instead of SMS, but the process is the same.
Why authenticator applications are preferred over SMS authentication
Authenticator apps provide better security than SMS codes for several reasons:
- Less chance of being hacked: Authenticator apps generate codes directly on your device, while SMS codes are sent over the internet and can be stolen.
- No risk of SIM swapping: Hackers can trick your phone provider into transferring your number to a new SIM card, allowing them to receive your SMS codes.
- No risk of interception: SMS codes can be stolen using man-in-the-middle attacks, where hackers eavesdrop on internet traffic.
- Codes change frequently: Authenticator apps refresh their codes every 30 to 60 seconds, making them harder to steal and use.
How hackers can steal SMS codes
Here are two common ways cybercriminals can steal SMS codes:
- Man-in-the-Middle Attacks – Hackers intercept your internet traffic when you connect to an unprotected Wi-Fi network (like public Wi-Fi at a coffee shop). This can let them steal SMS codes.
- SIM Swapping – A hacker contacts your mobile provider pretending to be you and tricks them into activating a new SIM card with your phone number. Now, they receive all your text messages, including your security codes.
How to keep your accounts safe
- Use an authenticator app instead of SMS authentication whenever possible.
- Protect your phone with a strong PIN or password.
- Avoid using public Wi-Fi when entering security codes.
- Never share your security codes with anyone.
- Be cautious of phishing scams that try to trick you into revealing your codes.
Ready to stay protected from digital threats, with experienced professionals overseeing your security?
Request a private consultation to find out whether Richter Guardian is a good fit for you.
BMO Scam Highlighting Vulnerabilities in Two-Factor Authentication
A BMO scam exploited two-factor authentication flaws to target customers. We break down the incident, implications for 2FA trust, and recommendations—including stronger options like hardware keys.
Introduction
A recent article published by CBC news highlighted a concerning scam that involved the Bank of Montreal (BMO). The scam managed to exploit vulnerabilities associated with the two-factor authentication (2FA) system of the bank. This advisory aims to provide an overview of the issue, its implications, and recommendations.
Summary of the incident
The scam primarily targeted customers with lines of credit. Perpetrators pose as bank employees and use a combination of phishing techniques and flaws in the 2FA process to gain unauthorized access to customers’ accounts, subsequently making unauthorized transactions.
Implications
- The trustworthiness of 2FA is at stake. Customers generally perceive 2FA as a robust security measure, but this incident underscores potential vulnerabilities.
- The scam demonstrates that even with the second layer of authentication, user accounts can be compromised if the process isn’t foolproof.
- Potential loss of customer trust in banking institutions due to such vulnerabilities.
Recommendations
- Stay Informed: Regularly update oneself about the latest scams and phishing techniques. Always be skeptical of unsolicited calls or emails asking for personal or banking information.
- Use Advanced Security Features: Wherever possible, use advanced security features like biometric authentication or hardware-based security keys.
- Monitor Accounts: Regularly check bank accounts for unauthorized transactions and report any discrepancies immediately.
- Stay Educated: Participate in security awareness sessions provided by your Richter Guardian team, the bank or other trusted organizations.
While 2FA is an essential security feature, it is not infallible. Richter Guardian clients should be proactive in understanding its limitations and continuously seek ways to enhance their security posture.
Contact us at anytime you are unsure. If you receive a call from someone purporting to be your bank and you are unsure, call us to help you determine the legitimacy of their communication.
Table 1 – Levels of two-factor authentication that may be available to protect your bank account.
Ready to stay protected from digital threats, with experienced professionals overseeing your security?
Request a private consultation to find out whether Richter Guardian is a good fit for you.