Hackers Account for 90% of Login Attempts at Online Retailers

Selling stolen personal data is a big business for hackers: Somewhere on the dark web, your e-mail address and a few passwords are probably for sale (hopefully, old ones). Cyber criminals buy troves of this information to try to login to websites where they can grab something valuable like cash, airline points, or merchandise like expensive cheese. Yes, cheese.

Online retailers are hit the most by these attacks, according to a report by cyber security firm Shape Security. Hackers use programs to apply stolen data in a flood of login attempts, called “credential stuffing.” These days, more than 90% of e-commerce sites’ global login traffic comes from these attacks. The airline and consumer banking industries are also under siege, with about 60% of login attempts coming from criminals.

These attacks are successful as often as 3% of the time, and the costs quickly add up for businesses, Shape says. This type of fraud costs the e-commerce sector about $6 billion a year, while the consumer banking industry loses out on about $1.7 billion annually. The hotel and airline businesses are also major targets—the theft of loyalty points is a thing—costing a combined $700 million every year.

Targeting “little monsters”

“Criminals harvest usernames and passwords from data breaches and test them on every website and mobile app imaginable,” Shape said in its report. The Mountain View, California-based company says it monitors 1.6 billion accounts for credential stuffing. The seven-year-old firm’s co-founders were Pentagon advisors and worked at defense contractor Raytheon.

The process starts when hackers break into databases and steal login information. Some of the best known “data spills” took place at Equifax and Yahoo, but they happen fairly regularly—there were 51 reported breaches last year, compromising 2.3 billion credentials, according to Shape. Hackers frequently target web forums: The Lady Gaga “Little Monster” fan site had a breach last year that reportedly impacted about 1 million accounts containing birthday, password, and e-mail information.

Adult and porn websites, by contrast, didn’t report any data breaches last year. It will take some time to know whether these sites successfully blocked hackers, or if they simply haven’t yet realized (or reported) that data may have been compromised. AdultFriendFinder.com’s database was one of the biggest credential exploits in 2016.

By the time you hear about a hacker intrusion, it’s usually too late; on average, it takes 15 months from the day credential data is stolen to the day an intrusion is revealed. That’s more than enough time for criminals to deploy the data of unsuspecting people in thousands of credential stuffing attacks.

Premium cheddar

Criminals steal personal data from places with weak protection and then use login data on sites and apps that are much higher value and better protected. Taking over bank accounts is one way to monetize stolen login information—in the U.S., community banks are attacked far more than any other industry group. According to Shape’s data, that sector is attacked more than 200 million times each day.

Another way to turn stolen data into cash is to buy merchandise, from gift cards to physical goods like electronics, that can easily be resold. It turns out that expensive cheese, like $200-per-pound Wyke Farms cheddar, is sometimes used in criminal schemes. Hackers use stolen credentials to break into online grocery accounts to buy high-priced cheese and then resell it to restaurants for cash, Shape says.

Airlines’ frequent flyer miles are also targeted. Shape points out that these miles or points aren’t protected with the sophisticated security used for financial accounts, and users are often much slower to notice their account has been broken into and drained.

Stolen frequent flyer miles have helped give rise to a gray market for these awards. Criminals sell them to specialist brokers who purchase award points from hotels and airlines. After the miles are transferred to the broker’s account, the cyber thief is usually paid via PayPal, Shape says. The mileage brokers then sell the points to online travel agencies, which they use to sell discounted tickets for business class and first class airfares. Some discounted online deals really are too good to be true.

Change your passwords

Cyber criminals are becoming more sophisticated, sharing successful techniques and tools with others hackers on the dark web. But not all is lost—the number of reported credential breaches was roughly stable at 51 last year, compared with 52 in 2016, Shape says. The size of data spills also declined. This suggests cyber security is improving, even as threats escalate. In the meantime, consumers can do their part to minimize these attacks by changing their passwords.