So there is a very significant new security breach at SnowFlake. They are one of the larger cloud providers like Amazon and Google that provide servers and host businesses.
A massive breach this spring affected an as-yet-unknown number of their 150+ customers. Passwords and personal data were stolen. Information is trickling out but it is believed that many of the half-billion Ticketmaster accounts and 50 million Santander bank accounts could have been breached. Unconfirmed as yet, but the hackers themselves claim another ~10 other large firms like Lending Tree, Allstate, Progressive, StateFarm, Advanced Auto Parts and others. It’s bad. #RealBad.
We cannot be sure this specific hack caused it, but suddenly - in the last two weeks - three of our accounts were hacked or purchases were made or attempted (Netflix, PayPal, Dunkin) so we changed everything. Likely, they buy a few passwords then try them everywhere. We’ll be filing identify theft with the police & federal agenc(ies) and putting freezes on all three credit check agencies to prevent opening accounts in our name. We’re also adding two-factor authentication and will rotate more often.
What kind of madman would dare hack my Dunkin? That was the straw that broke the camel’s back. And his routine DD order was frankly embarrassing.
I just had my identity hacked “again”. I had to unfreeze my credit agencies for something that I am doing and got a letter that I applied for a “Disney” credit card through Chase. Chase is notifying all agencies and certain things I have to do but put the freeze back on all 3. I was told to unfreeze for the few minutes they need it, then refreeze it right away. They told me once idenity hacked it just keeps happen? . Ugh. I mean… Disney credit card???
We’ve had our credit frozen with all three agencies for years now.
Something has to happen. They need to figure out another way to verify people. The password thing isn’t working, because people need to remember their PWs, and not everyone is organized enough to do it. So they use the same one over and over.
Face or finger print recognition won’t help you if they have your password. Multi-factor authentication is the only way to go.
I recently had a scare about my Facebook account being hacked (it was due to their outage) and how hard it would be to recover my pw and my account that I updated all my accounts to have multi-factor authentication. I had multi-factor for my financial accounts, but not for my social media account before.
So I always worry that kind of notification can be a scam. It should be safe as long as I go to google (ie don’t use a link provided in email), right?
This type of attack is called credential stuffing. They get any single password and use bots and scripts to try it on hundreds of sites and find any site that also uses that password. That’s why we had four random sites hit at once.
I read that the this became a hot issue very recently because the hackers produced a set of large, linked lists that put various pieces of personal info together
.