{"id":3735,"date":"2021-05-25T09:02:00","date_gmt":"2021-05-25T07:02:00","guid":{"rendered":"https:\/\/blog.passwordsafe.de\/?p=3735"},"modified":"2022-01-14T11:55:40","modified_gmt":"2022-01-14T11:55:40","slug":"notification-your-password-has-been-compromised-what-you-should-pay-attention-to-now","status":"publish","type":"post","link":"https:\/\/www.passwordsafe.com\/en\/blog\/notification-your-password-has-been-compromised-what-you-should-pay-attention-to-now\/","title":{"rendered":"Notification: “Your password has been compromised”"},"content":{"rendered":"

“Data breach”, “Data leak”, “Your password has been compromised”. Not only do nightmarish scenarios play out in your head when you hear these words, but you inevitably wonder: what’s the right thing to do now? In this post, you’ll learn how to find out if your passwords have been compromised, and if they have – what to do about it.<\/strong><\/p>

For World Password Day on May 6, we featured the three worst hacking attacks of the last few years here on the blog. If you want to read them, you can find the whole post here<\/a>. Through the blog article, it becomes frighteningly clear how many passwords have been compromised in recent years. To briefly explain, a system or data set can be considered compromised when the owner of the system, database, or data set no longer has control over its proper functioning and its security. In other words, hundreds of millions of hacked pieces of information are floating around the web. This includes not only personal information such as name, email address and phone number, but also unencrypted passwords, credit card information and passport numbers.<\/p>

Convenience jeopardizes security<\/h3>

What’s particularly bad about this is that one in three users uses the same password for multiple services, and almost 70% don’t change their passwords at regular intervals. And once a password and its associated email address have been hacked, hackers can easily access other accounts if they have the same credentials. The reasons for easy and same passwords are lack of motivation and willingness to remember hard and complex passwords. This is somehow understandable with “jd:9_L!(heP*BhI”. However, in this day and age and the multitude of hacked accounts, comfort should no longer be an excuse to protect one’s precious personal data with “Passw0rd1!”. Because the reality is frightening: in 2020 alone, 172 data leaks involving around 2 billion identities were published on the Internet.<\/p>

It gets worse every year<\/h3>

Recently, the Hasso Plattner Institute’s<\/a> new cybersecurity report came out. In 2021, security researchers found even more leaks from German websites than in 2020, and digital identity theft also went up. HPI Director Professor Christoph Meinel commented:” “Even though there is no 100 percent protection against attacks on the Internet, it is essential to protect personal data as good as possible. This includes choosing long individual and complex passwords and regularly checking whether personal data is affected, such as can be done free of charge using our HPI Identity Leak Checker.<\/p>

Ignorance does not protect, even on the Internet<\/h3>

Strong passwords are important and you should choose a unique and complex password for every application from now on. But what if one or more of your passwords have already been compromised? Will users be notified when their accounts have been hacked? The short answer is yes, they should. Often users are notified via a notice on the landing page, or a newsletter, a press release is sent to all users. But who among us reads press releases. Who of us ever signs up via the landing page of the email provider in times of mailing apps and Outlook. A message like that can quickly get lost in the flood of information we ingest every day. And then?<\/p>

Become active yourself with the Identity Leak Checker<\/h4>

With Identity Leak Pr\u00fcfer, the Hasso Plattner Institute’s online security checker, it is quick and easy to find out whether you yourself have been the victim of data theft. All the user has to do is enter his or her e-mail address and can check whether personal information is circulating freely on the Internet and can therefore be misused by unauthorized persons. This ability to check one’s e-mail address against more than 12 billion stolen identities is not possible in every country. So the first thing to do is to regularly check whether accesses have already been compromised. And not just privately. Hackers don’t stop at business access either. Therefore, employees should check not only private accesses but also business email addresses with the Identity-Leak checker.<\/p>

Under this link you will find the Identity Leak Checker and you can directly find out if and which of your personal data has already been compromised:<\/p>

https:\/\/sec.hpi.de\/ilc<\/a><\/p>

In the meantime, the checker can be used to compare more than 12.7 billion stolen identities available on the Internet.\u00a0 To date, more than 16.4 million users have already checked the security of their data over the past 5 years. In more than 4.1 million cases, users discovered that their e-mail addresses and other sensitive information had been published on the Internet.<\/p>

The List of Shame<\/h3>

This examiner also forms the data basis for the List-of-Shame, namely the most frequently used passwords of Germans, which HPI publishes on a regular basis.<\/p>

The top 10 German passwords in 2021: <\/strong><\/p>

  1. 123456<\/li>
  2. password<\/li>
  3. 12345<\/li>
  4. hello<\/li>
  5. 123456789<\/li>
  6. qwertz<\/li>
  7. treasure<\/li>
  8. tinker<\/li>
  9. berlin<\/li>
  10. 12345678<\/li> <\/ol>

    “Attention: Your email address appears in at least one stolen and unlawfully published identity database”.<\/strong>
    What does this even mean? Many hackers sell the stolen data on the darknet, hackers make billions in profits from it every year. The Internet black market is organized internationally and has been considered more lucrative than drug trafficking for some time. If, in addition, bank data is stolen, the criminals can even go shopping online in the name of the victims. That’s why you should change your password first!<\/p>

    First step: password change<\/h3>

    Both in private and business context. In a business context, this step is not only strongly advised, but the German Federal Office for Information Security states, “A password MUST be changed if it has become known to unauthorized persons or if there is a suspicion that it has. Passwords MUST be kept secret.<\/a>“<\/p>

    In doing so, the new password should follow some guidelines:<\/strong><\/p>