A data breach has my data.
What do I do? Hi Everyone.
Leo Notenboom for askleo.com
If you're not getting Confident Computing in your inbox
Every Tuesday visit, askleo.com/newsletter
and sign up today.
Each week I send out answers, tips and suggestions of what to do when
things like your email address showing up in a data breach happens.
Let's get right to the question.
I have just been advised that my data has
been breached from another website that I've never visited.
My email passwords and phone number have been compromised.
The website has not only never been visited by me, but nothing even close.
Yeah,
we hear about data breaches.
Gosh, it seems like almost every week there's a brand new one of some sort.
We get notification from services like haveibeenpwned, which is something I'll
recommend here in a few minutes that our email address has shown up somewhere,
or in some cases, that our passwords have shown up somewhere.
The question is, when that happens, what should you do?
The answer, as always, is it depends, but there are some things that you can
look at, pay attention to, and understand when you hear about your next breach.
First, let's talk about what data breach really means.
All that it means is that some service
has had its database exposed, stolen or whatever by hackers.
So, for example, maybe you use an online service, a popular online service.
They get hacked.
What that means is a hacker has somehow gotten into their network,
breached their servers, and copied things like their database of users.
That's typically what hackers are looking for.
They then copy that off somewhere and then start doing something with it.
We'll talk about what they do in just a minute.
But that's really all that a database breach is, or a data breach.
Is it's your data,
some data that's exposed publicly or to hackers when it's not supposed to be.
So what do you do about it?
Let's take a look at some of the pieces
of data that usually end up in that data breach.
The most common one is your email address.
Unfortunately, that actually shouldn't scare you that much.
It's not uncommon for email addresses to be known.
I have several.
They've appeared in multiple data breaches.
It's just the way things happen.
Many of my email addresses are out and out public
To begin with.
What it really means is when your email address shows up in a data breach,
the only thing realistically that's going to happen.
You'll get more spam.
That's why a good spam filter is something to pay attention to, and understanding what
is and is not spam if you encounter it in your inbox is also important.
But that's really the only
pragmatic result of having your email address exposed in a data breach.
Remember, your email address is probably
exposed already in several different ways, simply by sharing it with people.
The one that gets people's attention most
often is when they see the word password in these data breach notifications.
Now, as I discussed in a previous article, there's a key word you need to look for
when you read these notifications of data breaches, and that's the word hash.
If a data breach is listed as containing
passwords, then you need to understand which accounts are using your password
related to that breach and change those passwords immediately.
That's the risk.
If a data breach contains, for example,
your email address and your password your actual password,
then that means that hackers could potentially sign into your account using
that information on whatever service has been breached.
The good news here is is that 99 times out
of 100, I'll even say your password is not part of the data breach,
even if it says something about passwords in the notification.
If you read the notification carefully, it should say hashed passwords.
The difference is, and there's a previous article on this very topic.
The difference is that a hash in the database is what a service using
security properly uses to determine that you've Typed your
password incorrectly without them actually having to store your password
and that hash cannot be reverse engineered into your password.
So a password hash actually doesn't give a hacker any useful information.
They do not have your actual password,
and they can't use that hash to figure out what your actual password is.
So that's something to pay attention to.
If you don't see the word hash in a data
breach notification, change your password right away.
And of course, if you're ever uncertain, there's really no reason not to change
your password, even if it does say it's been hashed.
Now, there is one important caveat I want
to throw here when you go about changing your passwords.
If a service gets hacked and your password
is somehow exposed, it's not enough to change your password at that service.
You need to change that password at every
service where you happen to use the same password.
This is why we strongly recommend you never, ever use the same password
at multiple locations, because when hackers discover a password,
any password, they'll start trying it everywhere.
They will do everything they can to use that information.
And if you've got multiple accounts that use the same password,
there's a very good chance that hackers will then run around and try all
of the accounts that they can find with that same password.
So make sure when you change your password.
Change it to something that's unique and used at one and only one service.
And if it ever gets exposed in a breach,
never ever use that same password anywhere.
Again.
Everything else in data breaches?
Well, honestly, there's not a whole lot you can do about it.
With respect to your online accounts,
there isn't a lot of tangible action to be taken.
One of the things that all this additional
information, which is usually things like names and phone numbers and sometimes can
actually extend to things like tax ID numbers, social Security numbers.
I've even heard of driver's license numbers being exposed.
Sometimes when that information gets exposed, the hackers can't I
use that directly to do something to any of your accounts.
What they can do is use that information for identity theft.
They can use that information to set up accounts in your name,
using your information to make it look like you've set up an account that you've
never heard of, that you know nothing about and that you have no control over.
But because it's been set up in your name could potentially be liable for things
like the charges made against it unless you you take action right away.
So the thing to do if you discover that your information has been exposed
in a data breach is start paying attention to your credit card statements,
make sure that nothing is getting charged that you didn't actually charge.
Pay attention to your credit score.
There are places that will tell you what your current credit score is for free
and actually list the accounts that are associated with it.
And of course, as is the case with many of these breaches,
if it's a serious enough situation, consider using some kind of identity
monitoring service and or make sure to have your credit reports
locked so that random people can't use them to set up new accounts in your name.
Now, the original question talked about
a breach for a service that this person had never used.
There are a number of different reasons that can happen.
The most common, I will say, is that the breach happens at a company
that is either a parent company of a service that you do use,
or potentially a subsidiary of a service that you do use.
So, for example, that company may be the company that's
responsible for the credit card processing for a service that you happen to use.
Very common situation that services use other services to do work for them.
Therefore, it's also often common
for a breach at one service that you've never, ever heard of to actually impact
you indirectly because they actually are used by a service that you do use.
The bottom line here for this little aspect of the data breach scenario is not
to discount data breaches for services you've never heard of.
If they include your information, it's very likely that, in fact,
you are using them just indirectly through the services you do recognize.
I mentioned earlier the service. haveibeenpwned.
It is a service that I recommend.
In fact, I've got not only my email
addresses listed with haveibeenpwned as the owner of a domain like I own askleo.com
I'm actually able to register that domain,
and anytime that domain, any email address on that domain appears
in a breach, I get notified those notifications are really important.
I strongly suggest that you sign up for haveibeenpwned free notifications.
All you need to do is give them your email
address and then they'll let you know if it suddenly shows up in a data breach.
The other service that a lot of people
aren't quite as comfortable with, but I am, is from the same service.
Have I Been Pwned Passwords 158 00:10:10,880 --> 00:10:14,120 This is not a reporting notification test.
You type in a password that you use and Pwned Passwords will tell you if
that password has ever been discovered in a data breach.
If it has, stop using that password immediately
everywhere that you happen to be using it and make sure to once again set up
a unique password for every service that you do use.
Like I said, lots of people are uncomfortable typing
their password into this random third party service.
Have I Been Pwned and the individual
behind it has been around for a long enough time, and they've established
a very good reputation in the security industry that I literally have no
reservations entering my own passwords, whatever they might be into their service.
Nonetheless, I understand if you are
reticent to do so, I recommend that you do.
I recommend that you give it a try, maybe give it one of your
low hanging, fruit simple passwords that you're pretty sure isn't really
intended to be all that secure and see if it shows up to confirm the suspicion.
But nonetheless, have I been pwned and Pwned passwords are
two tools I think are valuable to add to your Arsenal to help you stay ahead or
on top of any of the data breaches that come up in the future.
For related links for updates for comments and more, visit
askleo.com/136751
I'm Leo Notenboom. This is Askleo.com.