Does size really matter?
“Hacker”Image courtesy of chanpipat / FreeDigitalPhotos.net
Last week, we learned about the “Largest Cybertheft Ring To Date Allegedly Stole 1.2 Billion Unique Records of Over 420,000 Web/FTP Sites“, which is by far the largest roundup of data items stolen, but in spite of that, is it something to worry about? Several experts are questioning this.
CNN, as well as some others, are saying the “Russia hack is not that scary“.
But wait a minute. Hold Security, the company that found this hack, may have a commercial interest in this reaction. Hold Security offers to tell companies if their usernames and passwords were compromised for the princely sum of $120. Arguably, Hold Security stood to make more money out of this story than the Russian hackers themselves.
That echoes my thoughts exactly, but I wasn’t ready to throw caution to the wind just yet. In mitigation of this, however, it should be pointed out that Hold Security is also offering free (for a limited time) assistance in this matter. Still, it does seem rather convenient, doesn’t it? That alone isn’t enough to dissuade me from recommending that people change their passwords, however. Still, the CNN article goes on:
While 1.2 billion is a big number, it appears that many of these credentials could have been obtained from previous large-scale breaches such as Adobe, Sony, LinkedIn, RockYou.com and eBay. The totals from these sites alone adds up to close to half a billion.
So, maybe there is nothing to panic about after all. Of course, if you hadn’t changed your passwords after any of those events, it is obvious you didn’t panic in the first place, but your information is still out there and vulnerable.
Also, if the article is correct, having the password hashes is not the same thing as having the passwords. Still, if they have enough time and horsepower, they could theoretically crack the password hash. By that time, though, security minded individuals will have probably already changed their passwords.
You do change your passwords often, right?
