Digital Shadows, the leader in digital risk protection, reveals new research assessing how cybercriminals exploit stolen credentials for accounts that we use every day, including bank accounts, social media and video streaming services. The study, entitled From Exposure to Takeover finds there are more than 15 billion credentials in circulation in cybercriminal marketplaces, many on the dark web – the equivalent of more than two for every person on the planet. The number of stolen and exposed credentials has risen 300% from 2018 as the result of more than 100,000 separate breaches. Of these, more than 5 billion were assessed to be ‘unique’ – i.e. they have not been advertised more than once on criminal forums.
Read More: GlobalFintechSeries Interview with Patrick Turiano, Director of Marketing at Paysafe Group
The majority of exposed account credentials belong to consumers and include usernames and passwords from bank accounts to video and music streaming services. Many account details are offered free of charge but of those on sale the average account trades for $15.43. Unsurprisingly, bank and financial accounts are the most expensive, averaging at $70.91, however they trade for upwards of $500, depending on the ‘quality’ of the account. In addition to being the most expensive, banking, and financial accounts accounted for 25% of all the advertisements analyzed.
The research also finds that access to organizations’ key systems trade at a significant premium. Usernames with “invoice” or “invoices” were by far the most common advertised and comprise 66% of the 2 million usernames assessed. “Partners” and “payments” came in a distant second and third place, both with 10% each. Dozens of advertisements for domain admin access are also advertised and in many cases are being auctioned to the highest bidder with prices ranging from $500 to $120,000 – with an average $3,139. Digital Shadows cannot confirm the validity of the data that the vendors purport to own, but listings included those for large corporations and government organizations in multiple countries.
Read More: Healthfully and Paya Deliver Expanded Patient Care and Payments Through New Partnership
Digital Shadows has alerted clients to 27.3 million username and password combinations in the last 18 months. Unfortunately for both consumers and business, account takeover has never been easier (or cheaper) to do for cyber criminals. A myriad of brute-force tools and account checkers are available on criminal marketplaces – and can be used with little technical expertise – for an average of $4.
