Can a data breach expose multiple accounts?
Hi, everyone. Leo Notenboom.
Here for askleo.com.
Let's get right to this question.
I've been in a data breach and I have multiple accounts on my phone.
Can they get my data from the other accounts, or they just get my information
of the account that's been in the data breach?
Normally, it's just the one account,
and the fact that it's all on your phone actually has almost nothing to do with it.
However, there are a couple of scenarios that we at least need to be aware of where
hacking one account could put some other accounts at risk.
One of the things that's important to understand is that a data breach does
not mean your account has been compromised.
All it really means is that some amount of information relating to your account
has been made public or has been made available to hackers.
Usually it's things like your email name,
your username, maybe your email address, maybe a few other random things.
Usually not your password.
Usually it's the hashed version of your password, which is less concerning because
there's no way to map that to the password.
So that does not give anybody access to your account.
All it really means is your information is out there.
However, we can't really make that assumption.
We can't assume that whatever service was
being breached was doing security properly.
Your password could have been exposed.
Hopefully, when you learn about
the breach, you'll be told that, yes, this information included your login ID,
your email address, your password, et cetera, et cetera.
If that's the case, of course, quick, go change the password on that account.
But it's important to understand that most breaches do not result in account hacks.
They result in other things, like potentially more spam,
more successful or targeted spam, and in some cases, identity theft.
The other thing I want to point out here is that the accounts you happen to be
using on a device actually don't really relate in a case like this.
The fact that account A was involved in a breach doesn't affect account B,
even though they both happen to be on your phone, for example.
So that's pretty safe, pretty secure.
However, I do keep saying that there are no
absolutes in this life, and this is one of them.
There is a scenario that is worth
understanding, because if the wrong account is hacked
in the wrong way, then yeah, it could put some of your other accounts at risk.
Here's how it works.
One of your accounts is involved in a data breach.
Well, this is common.
It happens to all of us pretty much once or twice a year these days.
It seems that breach exposes your password or enough other information for the hacker
to actually sign into and take over your account.
Fortunately, this is rare.
That's really good news,
because what that means is the scenario that we're working through is itself
really difficult to make happen and pretty rare.
Third, that account is a sign in account
or alternate email account for some of your other accounts.
So for example, if your Gmail account gets
breached, gets hacked, and you use that Gmail account as your
alternate email address for your Outlook.com account,
or it's your login address for your Dropbox account, just throwing out some
examples then those accounts are theoretically at risk.
Because number four,
if hackers realize this, then they can start doing password resets
on those other accounts since they have access to your primary email address or
to your account, that is the alternate account for other accounts.
They can now run around to those other
accounts, do password resets, and hack them all as well.
I'll just say neither rare nor common.
It happens.
It just doesn't happen all that often.
What's more common are that hackers,
when they find passwords, they just start trying those passwords
everywhere and that's how other accounts get hacked.
But normally this scenario that I've just
worked through, your account is involved in a data breach common.
That data breach exposes your password.
Uncommon, the account is the sign in or
alternate email account for something else.
Well, kind of common.
It can happen.
And hackers realize it the fourth item.
That's also not necessarily where they're generally headed.
So it really does boil down to a fairly
obscure scenario that you at least need to be aware of.
But it's not something that I would actually be afraid of.
By and large, a data breach usually only
impacts the account that has been breached.
And yes, change your password anyway.
Whether or not the information says
that the password was exposed, there's no way to know really.
So change the password of the account
that was breached, and as always, keep your security up to Snuff.
For updates, for comments,
for related links, and more via visit askleo.com/147210.
I'm Leo Notenboom.
And this is Askleo.com. Thanks for watching.