{"id":5146,"date":"2020-11-16T17:33:30","date_gmt":"2020-11-16T21:33:30","guid":{"rendered":"https:\/\/solutionsreview.com\/identity-management\/?p=5146"},"modified":"2020-11-16T17:33:30","modified_gmt":"2020-11-16T21:33:30","slug":"breaking-down-the-north-face-credential-stuffing-attack","status":"publish","type":"post","link":"https:\/\/solutionsreview.com\/identity-management\/breaking-down-the-north-face-credential-stuffing-attack\/","title":{"rendered":"Breaking Down the North Face Credential Stuffing Attack"},"content":{"rendered":"

\"Breaking<\/p>\n

Recently, outdoor apparel retailer North Face disclosed that it suffered from a credential stuffing attack. North Face stated the credential stuffing attack occurred on October 9, affecting an undisclosed number of customers. Hackers apparently gained users\u2019 usernames and passwords from a third-party website.\u00a0<\/span><\/p>\n

The company sent out a<\/span> data breach notification<\/span><\/a> to customers. While The North Face credential stuffing attack did not compromise financial information, it did expose information such as products purchased, billing and shipping addresses, names, birthdays, telephone numbers, email preferences.\u00a0<\/span><\/p>\n
Widget not in any sidebars
\n

Some Key Lessons from the North Face Credential Stuffing Attack<\/b><\/h3>\n

First, that another major retailer suffered from a credential stuffing attack indicates just how dangerous credential stuffing attacks can prove. Credential stuffing works by hackers simply trying previously stolen passwords and usernames and looking for repetitions. Any repetitions enable them access to new accounts on new victim businesses.\u00a0<\/span><\/p>\n

Therefore, your business must encourage both customers and employees to only use unique and strong passwords for their accounts. You can do this through mandatory password resets every few months, through the use of password managers. Also, you can deploy customer identity and access management and privileged access management solutions.\u00a0<\/span><\/p>\n

However, we also wish to confront a statement made by North Face in their data breach notification:\u00a0<\/span><\/p>\n

\u201cWe do not believe that the attacker obtained information from us that would require us to notify you of a data security breach under applicable law, but we are notifying you of the incident voluntarily, out of an abundance of caution.\u201d<\/span><\/p>\n

We cannot stress this enough: <\/span>this isn\u2019t how data breaches work. <\/span><\/i>Any information that appears on the Dark Web or ends up in the hands of danger becomes a threat to users\u2019. Hackers can use this information for future data breaches, for phishing or spear-phishing attacks, and other nefarious ends. In fact, users should know that non-financial information was breached <\/span>just as much as if financial information became stolen.\u00a0<\/span><\/i><\/p>\n

Users can replace their credit cards or freeze them; it is obnoxious but doable. However, users can\u2019t easily change their names or addresses. North Face, upon learning about the credential stuffing attack, immediately had the obligation to alert affected users.\u00a0\u00a0<\/span><\/p>\n

Expert Commentary<\/b><\/h3>\n

Vinay Sridhara is CTO of <\/span><\/i>Balbix<\/span><\/i><\/a>.\u00a0<\/span><\/i><\/p>\n

\u201cThis incident highlights the wide-spread issue of hackers capitalizing on weak password hygiene, taking advantage of rampant password reuse, and a lack of multifactor authentication (MFA). According to a recent study, roughly 80 percent of hacking-related breaches are due to compromised, weak, and reused passwords. Yet, 99 percent of people employees still reuse passwords across an average of 2.7 work and personal accounts.\u201d<\/span><\/p>\n

\u201cStrong password hygiene must be a top priority for every company and enterprises should scan for password reuse on an ongoing basis to limit their exposure. Additionally, NIST\u2019s Special Publication 800-63B:Digital Identity Guidelines recommends organizations to follow these four principles: 8 character minimum, no complexity or special character requirements, no password expiration, and to check against dictionaries and lists of previously breached passwords. Given that the amount of compromised credentials continues to grow, checking passwords against a dynamic database rather than a static list is critical.\u201d<\/span><\/p>\n

Learn more in our Identity Management Buyer\u2019s Guide<\/a>.<\/span><\/p>\n
Widget not in any sidebars
\n","protected":false},"excerpt":{"rendered":"

Recently, outdoor apparel retailer North Face disclosed that it suffered from a credential stuffing attack. North Face stated the credential stuffing attack occurred on October 9, affecting an undisclosed number of customers. Hackers apparently gained users\u2019 usernames and passwords from a third-party website.\u00a0 The company sent out a data breach notification to customers. While The […]<\/p>\n","protected":false},"author":41,"featured_media":4578,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[5,1],"tags":[987,1212,1583,16,112,1204,425,70,30,1582],"acf":[],"yoast_head":"\nBreaking Down the North Face Credential Stuffing Attack<\/title>\n<meta name=\"description\" content=\"Recently, outdoor apparel retailer North Face disclosed that it suffered from a credential stuffing attack. Learn more here.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/solutionsreview.com\/identity-management\/breaking-down-the-north-face-credential-stuffing-attack\/\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Ben Canner\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/breaking-down-the-north-face-credential-stuffing-attack\/\",\"url\":\"https:\/\/solutionsreview.com\/identity-management\/breaking-down-the-north-face-credential-stuffing-attack\/\",\"name\":\"Breaking Down the North Face Credential Stuffing Attack\",\"isPartOf\":{\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/breaking-down-the-north-face-credential-stuffing-attack\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/breaking-down-the-north-face-credential-stuffing-attack\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/solutionsreview.com\/identity-management\/files\/2019\/09\/swam.jpg\",\"datePublished\":\"2020-11-16T21:33:30+00:00\",\"dateModified\":\"2020-11-16T21:33:30+00:00\",\"author\":{\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/#\/schema\/person\/357f925262827fcf840b4341920a1541\"},\"description\":\"Recently, outdoor apparel retailer North Face disclosed that it suffered from a credential stuffing attack. Learn more here.\",\"breadcrumb\":{\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/breaking-down-the-north-face-credential-stuffing-attack\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/solutionsreview.com\/identity-management\/breaking-down-the-north-face-credential-stuffing-attack\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/breaking-down-the-north-face-credential-stuffing-attack\/#primaryimage\",\"url\":\"https:\/\/solutionsreview.com\/identity-management\/files\/2019\/09\/swam.jpg\",\"contentUrl\":\"https:\/\/solutionsreview.com\/identity-management\/files\/2019\/09\/swam.jpg\",\"width\":800,\"height\":400,\"caption\":\"UN Data Breach: Expert Commentary on a High-Profile Attack\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/breaking-down-the-north-face-credential-stuffing-attack\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/solutionsreview.com\/identity-management\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Breaking Down the North Face Credential Stuffing Attack\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/#website\",\"url\":\"https:\/\/solutionsreview.com\/identity-management\/\",\"name\":\"Identity and Access Management Solutions | Solutions Review\",\"description\":\"Evaluating Enterprise IAM Software, Identity Governance & Access Control Tools.\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/solutionsreview.com\/identity-management\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/#\/schema\/person\/357f925262827fcf840b4341920a1541\",\"name\":\"Ben Canner\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/63f68345052a446ce0cc9c802dd3f373?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/63f68345052a446ce0cc9c802dd3f373?s=96&d=mm&r=g\",\"caption\":\"Ben Canner\"},\"description\":\"Ben Canner is an enterprise technology writer and analyst covering Identity Management, SIEM, Endpoint Protection, and Cybersecurity writ large. He holds a Bachelor of Arts Degree in English from Clark University in Worcester, MA. He previously worked as a corporate blogger and ghost writer. You can reach him via Twitter and LinkedIn.\",\"url\":\"https:\/\/solutionsreview.com\/identity-management\/author\/bcanner\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Breaking Down the North Face Credential Stuffing Attack","description":"Recently, outdoor apparel retailer North Face disclosed that it suffered from a credential stuffing attack. Learn more here.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/solutionsreview.com\/identity-management\/breaking-down-the-north-face-credential-stuffing-attack\/","twitter_misc":{"Written by":"Ben Canner","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/solutionsreview.com\/identity-management\/breaking-down-the-north-face-credential-stuffing-attack\/","url":"https:\/\/solutionsreview.com\/identity-management\/breaking-down-the-north-face-credential-stuffing-attack\/","name":"Breaking Down the North Face Credential Stuffing Attack","isPartOf":{"@id":"https:\/\/solutionsreview.com\/identity-management\/#website"},"primaryImageOfPage":{"@id":"https:\/\/solutionsreview.com\/identity-management\/breaking-down-the-north-face-credential-stuffing-attack\/#primaryimage"},"image":{"@id":"https:\/\/solutionsreview.com\/identity-management\/breaking-down-the-north-face-credential-stuffing-attack\/#primaryimage"},"thumbnailUrl":"https:\/\/solutionsreview.com\/identity-management\/files\/2019\/09\/swam.jpg","datePublished":"2020-11-16T21:33:30+00:00","dateModified":"2020-11-16T21:33:30+00:00","author":{"@id":"https:\/\/solutionsreview.com\/identity-management\/#\/schema\/person\/357f925262827fcf840b4341920a1541"},"description":"Recently, outdoor apparel retailer North Face disclosed that it suffered from a credential stuffing attack. Learn more here.","breadcrumb":{"@id":"https:\/\/solutionsreview.com\/identity-management\/breaking-down-the-north-face-credential-stuffing-attack\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/solutionsreview.com\/identity-management\/breaking-down-the-north-face-credential-stuffing-attack\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/solutionsreview.com\/identity-management\/breaking-down-the-north-face-credential-stuffing-attack\/#primaryimage","url":"https:\/\/solutionsreview.com\/identity-management\/files\/2019\/09\/swam.jpg","contentUrl":"https:\/\/solutionsreview.com\/identity-management\/files\/2019\/09\/swam.jpg","width":800,"height":400,"caption":"UN Data Breach: Expert Commentary on a High-Profile Attack"},{"@type":"BreadcrumbList","@id":"https:\/\/solutionsreview.com\/identity-management\/breaking-down-the-north-face-credential-stuffing-attack\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/solutionsreview.com\/identity-management\/"},{"@type":"ListItem","position":2,"name":"Breaking Down the North Face Credential Stuffing Attack"}]},{"@type":"WebSite","@id":"https:\/\/solutionsreview.com\/identity-management\/#website","url":"https:\/\/solutionsreview.com\/identity-management\/","name":"Identity and Access Management Solutions | Solutions Review","description":"Evaluating Enterprise IAM Software, Identity Governance & Access Control Tools.","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/solutionsreview.com\/identity-management\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/solutionsreview.com\/identity-management\/#\/schema\/person\/357f925262827fcf840b4341920a1541","name":"Ben Canner","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/solutionsreview.com\/identity-management\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/63f68345052a446ce0cc9c802dd3f373?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/63f68345052a446ce0cc9c802dd3f373?s=96&d=mm&r=g","caption":"Ben Canner"},"description":"Ben Canner is an enterprise technology writer and analyst covering Identity Management, SIEM, Endpoint Protection, and Cybersecurity writ large. He holds a Bachelor of Arts Degree in English from Clark University in Worcester, MA. He previously worked as a corporate blogger and ghost writer. You can reach him via Twitter and LinkedIn.","url":"https:\/\/solutionsreview.com\/identity-management\/author\/bcanner\/"}]}},"_links":{"self":[{"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/posts\/5146"}],"collection":[{"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/users\/41"}],"replies":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/comments?post=5146"}],"version-history":[{"count":0,"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/posts\/5146\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/media\/4578"}],"wp:attachment":[{"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/media?parent=5146"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/categories?post=5146"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/tags?post=5146"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}