{"id":3670,"date":"2018-11-07T12:42:50","date_gmt":"2018-11-07T16:42:50","guid":{"rendered":"https:\/\/solutionsreview.com\/identity-management\/?p=3670"},"modified":"2018-11-07T12:42:50","modified_gmt":"2018-11-07T16:42:50","slug":"credential-stuffing-led-hsbc-data-breach","status":"publish","type":"post","link":"https:\/\/solutionsreview.com\/identity-management\/credential-stuffing-led-hsbc-data-breach\/","title":{"rendered":"How Credential Stuffing Led to the HSBC Data Breach"},"content":{"rendered":"

\"How<\/p>\n

Yesterday HSBC Bank publically disclosed what appears, on the surface, a relatively minor data breach. <\/span><\/p>\n

Based in the U.K., HSBC Bank announced unauthorized users gained access to a host of financial and personal information. In an official statement to customers, HSBC Bank said: “The information that may have been accessed includes your full name, mailing address, phone number, email address, date of birth, account numbers, account types, account balances, transaction history, payee account information and statement history where available.\u201d<\/span><\/p>\n

\t\t\t

\"Download<\/a><\/p>\n<\/div>\n\t\t<\/div><\/div><\/p>\n

The accounts were illicitly accessed between October 4 and October 14 of this year. HSBC has taken steps to fortify their accounts since discovering the unauthorized access: “We responded to this incident by fortifying our log-on and authentication processes, and implemented additional layers of security for digital and mobile access to all personal and business banking accounts.\u201d HSBC Bank also suspended online access to prevent other unauthorized entries to affected accounts. <\/span><\/p>\n

They added: “HSBC regrets this incident, and we take our responsibility for protecting our customers very seriously. We have notified those customers whose accounts may have experienced [unauthorized] access, and are offering them one year of credit monitoring and identity theft protection service.” <\/span><\/p>\n

HSBC stated less than one percent of their U.S. customer base was affected by the data breach, which may be only about 14,000 people. Compared to some of the most prominent breaches of the past two years, this breach does not compare in sheer number. \u00a0<\/span><\/p>\n

So why does data breach matter if so few people were affected? While it has not been definitively confirmed as of yet, the attack vector these hackers chose to access the HSBC bank accounts should matter a great deal to enterprises: credential stuffing.<\/span><\/p>\n

In a credential stuffing attack, previously stolen or leaked usernames, passwords, or other personal data are exploited to access users\u2019 other accounts on different sites, networks, or databases. This can create a cascade issue as more breaches mean more passwords exposed and thus more breaches in the future. \u00a0<\/span><\/p>\n

About 232 million credential stuffing attacks afflict financial institutions daily and about 1 in 2,000 are successful, according to <\/span>Shape Security<\/span><\/a>. Also at particular risk of credential stuffing attacks are hospitality, airlines, and retail enterprises. \u00a0<\/span><\/p>\n

At its core, credential stuffing exploits credential and password reuse. Of course, according to identity management best practices, users shouldn\u2019t reuse passwords and instead generate a unique password for every account. However, users continue to use repeated passwords quite frequently despite the warnings. Credential stuffing can severely harm your business, as users may reuse passwords to access their work accounts…including access to your most sensitive digital assets. <\/span><\/p>\n

The HSBC data breach was relatively minor. However, a credential stuffing attack on your enterprise might not be as inconsequential. You need to take the steps to prevent such an attack from affecting your business: <\/span><\/p>\n