Breaches Be Loco

The amount of personal data we have floating around out there on the internet is staggering. Online banking, shopping, social media; all filled to the brim with email addresses, passwords, financial information and more. We take for granted simply logging into a site, taking care of something such as a purchase or a financial transfer, and reaping the convenience of such. The trust we place with these sites and services is that they’ll do a good job of keeping that data safe and private. What happens, then, when this trust is misplaced and a website experiences a data breach? Are we simply at the mercy at that point of whomever ended up with our credentials?

Data breaches occur when, through either a malicious act or accidental release into the wild, data which should be kept private and secure enters the public domain and becomes available for misuse. Almost half of all data breaches are the result of hacking, which given the black market dollar value of a set of credentials, shouldn’t be a surprise. There are times, especially when data breaches occur with high profile companies or those dealing in a controversial space, that the stolen data will be published to certain websites for all to see. This perhaps is the situation wherein your username and password or credit card information end up being made public, which is most worrisome for the average person.

On a happier note though, it’s easier than ever to be notified about your details appearing in one of these breaches! If you use a password manager, such as the one built into your browser or smartphone, you’ll typically get an alert to warn you of the issue. There are also services available which will, for a small monthly fee, monitor your online presence actively. Of course the huge examples will be hard to miss and will almost certainly make national news. Facebook had a very high profile breach back in 2019, where 540 million records were compromised. In these examples, typically the website itself will reach out to users with methods to re-secure their data.

So what to do then, if you’re the victim of something like this? First and foremost is not to panic. Often the scale of the data exposed means you’d have to be very unlucky to fall victim to your credentials being misused. While it’s best practice to have a different password for everything which you log in to, I’m not blind to the unreasonableness of that. This means your first port of call is to change the password associated with the service which has experienced the issue, and then also change it on any site on which you use the same credentials. You should also, on sites which support it, use the “log out of all devices” function, just in case someone managed to use a password prior to you changing it.

After this, it’s time to make yourself more resilient to future breaches! While it’s more work for each site to have its own credentials, it does pay dividends when it comes down to security. You can make your life easier by using password managers, which will often generate unique logins for each service you use. This cuts down the potential impact of any one username being leaked, as it’s only useful for one site. While we can’t escape the potential for our data falling into the wrong hands, we can definitely all be more vigilant to mitigate that risk.