Resources Types: Whitepaper

Identity Theft 101

Identity Theft 101

WHITEPAPER

Identity Theft 101

What it is, how it happens, and how to prevent it

Identity Theft 101

Identity theft means that your personal and confidential information has been stolen and is being used without your permission to apply for lines of credit, make purchases, and commit other types of fraud.

Identity theft is skyrocketing worldwide, fueled by so many tactics that even security professionals can’t keep up. 

Are you a target? The short answer is yes. Everyone’s personal data is worth something to fraudsters.

SpyCloud worked with the Communications Fraud Control Association (CFCA) to create Identity Theft 101, a consumer education document that describes:

  • How identity theft happens
  • Tips for reducing your risk
This asset is free to download. Simply click the link to access the PDF directly.

Get Identity Theft 101

Download the PDF Here

Related Resources

The SpyCloud Difference

Truly Actionable Recaptured Data

SpyCloud solutions are backed by the world’s most current and comprehensive repository of recaptured data from breaches, malware infections, and other underground sources – with billions of exposed credentials and PII. It’s the same data that fraudsters use, but we make it actionable to prevent account takeover, ransomware attacks, and online fraud.

Learn More About Our Data

Check Your Exposure

See your real-time breach exposure details powered by SpyCloud data.

Check Your Exposure

U.S. Government Credential Exposure Report

2021 SPECIAL REPORT

U.S. Government Credential Exposure

There is arguably no bigger producer, collector, consumer, and disseminator of data on the planet than the United States government. And yet, SpyCloud analysis has shown that its vast network of employees at the federal, state and local levels, including its contractors, are leaving that data exposed to enormous risk.

In 2020 alone, SpyCloud found:

    • 269,690 plaintext government credentials leaked in 465 breaches.
    • More than 1 million pairs of exposed emails and passwords for corporate accounts at the 27 largest companies in the defense industrial base.
    • 800,000 exposed corporate credentials (more than 7,000 per company) for employees at the 109 Fortune 1000 companies in the energy sector.

These exposures provide potential avenues for bad actors to access government resources and create massive risk in the government supply chain.

As this report explains, the prevalence of password reuse and loose credential security protocols are gifts to cybercriminals that expose the U.S. to significant risks. Our “Special Report: 2021 U.S. Government Credential Exposure” provides the prescriptive guidance needed to address this trend, along with a new framework for securing credentials that applies to employees, suppliers, and citizens.

Solution: Account Takeover Prevention

Detect and automatically reset exposed credentials before criminals can exploit them to perpetrate targeted attacks like ransomware.

Learn More

Download the Report

A few of our happy customers:

The SpyCloud Difference

SpyCloud provides the earliest detection of potentially compromised accounts – those using credentials that have appeared in a third-party breach or were siphoned from a malware infection and are therefore at risk of account takeover. And we automate the remediation of exposed passwords, enabling government agencies to lock down accounts quickly, without the need for additional resources. 

Our goal is to help organizations to protect themselves from criminal activity and disrupt criminals’ ability to profit from stolen data.

Learn More About Us

Check Your Exposure

See your real-time account takeover exposure details powered by SpyCloud data.

Check Your Exposure

Business Email Compromise 101

bec-101-whitepaper

WHITEPAPER

Business Email Compromise 101

BEC Remains A Persistent Threat For One Big Reason
– It’s Still Really Effective

bec-101-whitepaper

According to the FBI’s Internet Crime Complaint Center (IC3), losses from BEC surpassed $1.8 billion in 2020 – an average of $93,000 per incident.

BEC is challenging to prevent, especially when vendors are compromised, but SpyCloud believes prevention begins with addressing the human attack surface, particularly the prevalence of poor password hygiene. When passwords are reused between employees’ or vendors’ work and personal accounts, credentials that have already been exposed in a data breach are fair game for use in BEC campaigns.

This report examines the very human problem of password reuse and the social engineering tactics used by criminals to dupe organizations. As this report explains, all it takes to steal from your business is a single compromised account.

Solution: Account Takeover Prevention

Detect and automatically reset exposed credentials before criminals can exploit them to bypass MFA and take over accounts.

Learn More

Zero Trust

Download BEC 101

A few of our happy customers:

The SpyCloud Difference

SpyCloud provides the earliest detection of potentially compromised accounts – those using credentials that have appeared in a third-party breach and are therefore at risk of account takeover. And we automate the remediation of exposed passwords, enabling enterprises to lock down accounts quickly, before targeted attacks like BEC can happen. 

Our goal is to help organizations to protect themselves from criminal activity and disrupt criminals’ ability to profit from stolen data.

Learn More About Us

Check Your Exposure

See your real-time account takeover exposure details powered by SpyCloud data.

Check Your Exposure

Passwords are Dead; Long Live Passwords: The Fate of Passwords in the Digital Age

Passwordless Authentication Whitepaper

WHITEPAPER

Passwordless Authentication & the Fate of Passwords in the Digital Age

Passwords are Dead; Long Live Passwords

Passwordless Authentication Whitepaper

Passwords are a fact of life in the modern era. The proliferation of digital services in recent years means people are creating more user accounts than ever and juggling, on average, anywhere from 20 to 100 passwords. Trying to remember them all is impossible, and being asked constantly to create new, unique ones can be tedious. This results in using the same or similar passwords for work and personal accounts which can leave enterprises and their customers at risk of account takeover (ATO).

Vendors are trying to solve password challenges by replacing them with alternative “passwordless” solutions. But despite their weakness as authentication tools and the hassle they may cause some, passwords are here to stay for the foreseeable future. They are a simple, cost-effective, and ubiquitous security measure that is easy to implement and has virtually no learning curve for the average user.

Examining the state of password security today and the challenges facing passwordless solutions, this SpyCloud report [PDF] offers clear guidance on protecting your user accounts without having to reinvent the wheel.

Download the Report

Click here to access the PDF
Solution: Account Takeover Prevention

Reset stolen passwords before criminals can use them to defraud your users or access sensitive corporate data.

Learn More

A few of our happy customers:

Related Resources

The SpyCloud Difference

Truly Actionable Recaptured Data

SpyCloud solutions are backed by the world’s most current and comprehensive repository of recaptured data from breaches, malware infections, and other underground sources – with billions of exposed credentials and PII. It’s the same data that fraudsters use, but we make it actionable to prevent account takeover, ransomware attacks, and online fraud.

Learn More About Our Recaptured Data

Check Your Exposure

See your real-time breach exposure details powered by SpyCloud data.

Check Your Exposure

Telecommunications Industry Credential Exposure: 2021 Special Report

Image of Telecommunications Industry Credential Exposure Report

2021 SPECIAL REPORT

Telecommunications Industry Credential Exposure

Image of Telecommunications Industry Credential Exposure Report

Every industry is vulnerable to cybercrime, but perhaps none more so than telecommunications. Telcos are responsible for securing a huge number of mobile subscribers’ accounts as well as their personal data, and yet 76% of their employees are reusing passwords across multiple accounts.

Once a cybercriminal knows the password for one account, they will test it on other accounts, and if the account owner has reused the password, the criminal has easy access. That makes it extremely important for telco security teams to identify vulnerable accounts early so they can lock them down, force password changes, and remediate malware infections before they can be compromised.

Examining the unique security challenges of this vital sector, this SpyCloud report provides guidance for shoring up defenses and preventing bad employee habits from leading to further damage:

  • Learn why the bad habits of telco employees expose customers to fraud
  • See why subscriber malware infections are a telco’s problem
  • Understand why stolen phone numbers have become increasingly valuable to cybercriminals
  • Discover how simple preventative measures can limit the effects of employee & subscriber data exposure
Solution: Account Takeover Prevention

Reset stolen passwords before criminals can use them to defraud your users or access sensitive corporate data.

Learn More

Zero Trust

Download the Report

A few of our happy customers:

Related Resources

The SpyCloud Difference

Truly Actionable Recaptured Data

SpyCloud solutions are backed by the world’s most current and comprehensive repository of recaptured data from breaches, malware infections, and other underground sources – with billions of exposed credentials and PII. It’s the same data that fraudsters use, but we make it actionable to prevent account takeover, ransomware attacks, and online fraud.

Learn More About Our Recaptured Data

Check Your Exposure

See your real-time breach exposure details powered by SpyCloud data.

Check Your Exposure

MFA Bypass 101

MFA Bypass 101 Whitepaper

WHITEPAPER

MFA Bypass 101

How Hackers Combine Attack Methods and Stolen Credentials to Sidestep Multi-Factor Authentication

MFA Bypass 101 Whitepaper

Microsoft famously stated that user accounts are “more than 99.9% less likely to be compromised if you use MFA.” While there is little doubt MFA (multi-factor authentication) is an effective deterrent against cyber attacks, it’s not a “magic bullet.”

In this whitepaper, SpyCloud examines the human weaknesses and technological pain points in MFA to show how the most basic personal identifiers are being used to gain a foothold in users’ computers and wreak havoc. Educating your users on basic cyber hygiene while monitoring for compromised credentials within your network can ensure you’re getting the most from your MFA investment.

We explain:

  • How breached passwords and PII fuel criminals’ ability to circumvent MFA
  • Five common attack methods in plain English
  • Preventative methods to use in a layered cybersecurity program
Solution: Account Takeover Prevention

Detect and automatically reset exposed credentials before criminals can exploit them to bypass MFA and take over accounts.

Learn More

Zero Trust

Get MFA Bypass 101

A few of our happy customers:

The SpyCloud Difference

With solutions backed by the world’s most current and comprehensive repository of recaptured data from breaches, malware infections, and other underground sources, SpyCloud provides the earliest detection of accounts at risk of ATO. And we automate the remediation of exposed passwords, enabling enterprises to lock down accounts quickly, before damage is done. 

Our goal is to help organizations to protect themselves from criminal activity and disrupt criminals’ ability to profit from stolen data.

Learn More About Us

Check Your Exposure

See your real-time account takeover exposure details powered by SpyCloud data.

Check Your Exposure

Credential Stuffing 101

Credential Stuffing 101

WHITEPAPER

Credential Stuffing 101

How these attacks work, why they persist, and what you can do to prevent them

Credential Stuffing 101
“As long as there are criminals willing to pay for stolen data and consumers failing to protect themselves, there will be people working to access data that isn’t theirs.”
Like all trends, cyber threats come in waves and credential stuffing attacks are no exception. Their sudden surge in popularity sends cybersecurity teams scrambling to respond to these overwhelming attacks, leaving little room to educate themselves and users on preventive measures, let alone address the underlying concerns that allow them to flourish. Among them:
  • Gigantic troves of stolen user account credentials are widely available for criminals to purchase
  • Consumers of digital services insist on using weak, easy-to-remember passwords for multiple accounts
  • Automated credential stuffing software makes perpetrating these malicious acts fairly easy
Regardless of your industry, credential stuffing is an equal opportunity offender and the implications are very real. In this report, SpyCloud taps its expertise in helping organizations recover exposed credentials to help you understand the anatomy of credential stuffing attacks, why they persist, and what you can do to prevent them.
Solution: Consumer ATO Prevention

Protect your users from account takeover fraud and unauthorized purchases.

Learn More

Download Credential Stuffing 101

A few of our happy customers:

The SpyCloud Difference

With solutions backed by the world’s most current and comprehensive repository of recaptured data from breaches, malware infections, and other underground sources, SpyCloud provides the earliest detection of accounts at risk of ATO and credential stuffing. And we automate the remediation of exposed passwords, enabling enterprises to lock down accounts quickly, before damage is done.

Our goal is to help organizations to protect themselves and their customers from criminal activity and disrupt criminals’ ability to profit from stolen data.

Learn More About Us

Check Your Exposure

See your real-time account takeover exposure details powered by SpyCloud data.

Check Your Exposure

Understanding the SolarWinds Supply Chain Attack

Whitepaper: Understanding the SolarWinds Supply Chain Attack
WHITEPAPER

Understanding the SolarWinds Supply Chain Attack

Whitepaper: Understanding the SolarWinds Supply Chain Attack

“This is the largest and most sophisticated sort of operation that we have seen.”

– Brad Smith, President, Microsoft

In December 2020, the public learned that an advanced persistent threat (APT) had compromised the SolarWinds Orion software supply chain and delivered a software update containing malicious code to over 18,000 customers. The scope of this attack is unprecedented, and the untangling exactly what happened will take years.  

Drawing on testimony from the February 23, 2021 Senate Select Committee on Intelligence hearing, SpyCloud has broken the attack down into three stages, with a focus on the critical roles played by identity and password security. 

No single security solution could have prevented such a sophisticated, surgical attack; however, the incident underscores the risks posed by weak and stolen credentials. Read the whitepaper to learn more about what happened, and how SpyCloud could have helped at each stage of the attack. 

 

Download the Whitepaper

Understanding the SolarWinds Supply Chain Attack

Get the PDF

A few of our happy customers:

The SpyCloud Difference

Truly Actionable Recaptured Data

SpyCloud solutions are backed by the world’s most current and comprehensive repository of recaptured data from breaches, malware infections, and other underground sources – with billions of exposed credentials and PII. It’s the same data that fraudsters use, but we make it actionable to prevent account takeover, ransomware attacks, and online fraud.

Learn More About Our Recaptured Data

Check Your Exposure

See your real-time breach exposure details powered by SpyCloud data.

Check Your Exposure

2021 Annual Credential Exposure Report

Annual Credential Exposure Report

REPORT

2021 Annual Credential Exposure Report

Annual Credential Exposure Report

2020 was not a typical year. Between the onset of a global pandemic, the shift to remote life, and the turbulent political landscape, consumers shifted their behavior dramatically — and criminals followed suit, swiftly finding ways to exploit these changes. 

Throughout this unusual time, SpyCloud’s researchers have been embedded in criminal networks, using human intelligence (HUMINT) to recover stolen data before it reaches a broader criminal audience or goes public. As a result, the 1.5 billion credentials and 4.6 billion PII assets we’ve recovered provide unique insight into the breaches and botnet logs that have been released to criminal communities over the last year. 

Download the report to see:

  • Trends our researchers have observed within cybercriminal communities over the last 12 months
  • What 2020 themes appeared in people’s passwords last year (covid-19, sourdough, and more)
  • How many credentials containing .gov emails were exposed last year, and what passwords were most popular with government employees
  • The top 10 breaches released over the last 12 months

Download the Report

Click here to access the PDF
Solution: Account Takeover Prevention

Reset stolen passwords before criminals can use them to defraud your users or access sensitive corporate data.

Learn More

A few of our happy customers:

Related Resources
Case Study

Top 10 Travel Booking Site

Preventing account takeover begins with monitoring the dark web, but without the ability to match user accounts with a database of exposed credentials, a top 10 travel booking site was vulnerable to attack.

Read More

The SpyCloud Difference

Truly Actionable Recaptured Data

SpyCloud solutions are backed by the world’s most current and comprehensive repository of recaptured data from breaches, malware infections, and other underground sources – with billions of exposed credentials and PII. It’s the same data that fraudsters use, but we make it actionable to prevent account takeover, ransomware attacks, and online fraud.

Learn More About Our Data

Check Your Exposure

See your real-time breach exposure details powered by SpyCloud data.

Check Your Exposure

2021 Report: Breach Exposure of London’s FTSE 100

FTSE 100 Breach Exposure Report

REPORT

Breach Exposure of London's FTSE 100

FTSE 100 Breach Exposure Report

Even employees at the world’s largest and most successful organisations use weak passwords, and frequently reuse corporate credentials as personal logins, regardless of security guidelines that prohibit such behavior. When those third-party sites are subject to data breaches, reused employee logins provide easy entry points to corporate systems and networks.

To provide a snapshot of the breach exposure affecting major enterprises, we examined SpyCloud’s entire database to see what exposed data we could tie to FTSE 100 companies and their subsidiaries. We found over 39 million breach assets, including 2.6 million plaintext credentials, tied to these employees. All of this data is available to cybercriminals and can be used for malicious purposes.

Download the report to see:

  • What kinds of stolen employee data criminals have on FTSE 100 employees, and the dangers it presents for these organisations
  • Which industries are plagued most by employee password reuse
  • The most popular passwords of FTSE 100 employees
  • How many employee and consumer credentials have been collected by keyloggers

Download the Report

Click here to access the PDF
Solution: Account Takeover Prevention

Reset stolen passwords before criminals can use them to defraud your users or access sensitive corporate data.

Learn More

The SpyCloud Difference

SpyCloud provides the earliest detection of potentially compromised accounts – those using credentials that have appeared in a third-party breach and are therefore at risk of account takeover. And we automate the remediation of exposed passwords, enabling enterprises to lock down accounts quickly, before damage is done. 

SpyCloud safeguards more than 2 billion employee and consumer accounts from account takeover and follow-on attacks.

Learn More About Us

Check Your Exposure

See your real-time breach exposure details powered by SpyCloud data.

Check Your Exposure