Yesterday, several news outlets reported the theft of 1.2 billion Internet user names and passwords, collected from multiple websites. The breach was discovered by Hold Security, a security and risk firm, who identified a group of hackers responsible for stealing information from over 420,000 web and FTP sites.
How does this affect you?
Currently, we do not know which websites might have been breached, as Hold Security is withholding this information to prevent further exploitation of security vulnerabilities. However, we do know that no major email services, like Gmail, were affected. Additionally, there has been no evidence that these hackers collected any financial information.
What do you need to do?
Although it’s impossible to know if your user name and password were stolen from any given site, it’s safer to assume they have been due to the size of the breach. ITS Security is monitoring activity to ensure data is not compromised at WCMC. However, it’s best to follow these procedures:
Change your password. Visit all the sites you use to store sensitive information, like credit card numbers, health records, and similar data. Change your password for each one, making sure you do not use the same password across all sites.
Be wary of spam messages. It’s possible that these hackers may eventually use this information to send malicious messages meant to steal more personal data from you. ITS has identified ways to determine whether an email is spam. When in doubt, send any suspicious emails as an attachment to is-spam@med.cornell.edu.
Protect your device. Ensure you have anti-virus protection. If you’re using an ITS-tagged computer, you can download Symantec anti-virus software for free from our website. Additionally, visit the SMARTDesk and ask about getting your laptop or mobile device encrypted.
More information on how to protect your personal data can be found at the sources below:
The New York Times: http://www.nytimes.com/interactive/2014/08/05/technology/what-you-need-to-know-with-russian-hack.html
CNN Money: http://money.cnn.com/2014/08/06/technology/security/russian-password-safety/index.html?iid=EL
Hold Security: http://www.holdsecurity.com/news/cybervor-breach/