You’re a popular service that people likely subscribe to at a cost (e.g.
Identify accounts with a large quantity of loyalty points, to make a purchase when payment details aren’t available.
Chances are, you ask people to register as they make purchases so that you can store some of their information (address, payment details) to enhance their user experience when they return.ĭepending on your scale or target market, you may also be attempting to retain those customers with loyalty schemes, such as a points based system based on previous purchases. You are an online shop, hopefully selling something people want to buy. Lets walk through some examples, and explain why they might be an interesting target for some nefarious people: Example 1 - The E–Commerce Store It all depends how valuable your users are and how the contents of the account may be used or sold on to others. My website doesn’t hold any important information, so I doubt we would be a target…ĭepending on your business, you may be more attractive to this attack than others. So, at this point, you might be thinking: This article will provide you with an overview of why and how these attacks take place, as well as provide you with some fingerprints and identifiers to help you monitor your environment for these types of attacks. These details can then be used by nefarious people to then systematically attempt to log into your service/business, in an attempt to takeover these accounts. With quite literally billions of leaked credentials available online, it is highly likely that some of these will be credentials for your customers - or worse - from your employees or organisation. It is a very targeted attack against the user in question, and someone has managed to successfully guess or bruteforce the users login details.A third party marketing company with names and email addresses. A third party to the company in question has suffered a breach, meaning only partial details have gone public e.g.The person has reused credentials from another website which has suffered a breach, and these are now being used by malicious folk against other services.While there is the possibility that this may be the first sign of a breach, there are some other reasons why this may have happened: At Breach Insider, we see a similar story over and over again via social media and other outlets, with folks suggesting various companies may have suffered a breach due to their accounts becoming compromised, or receiving spam:
0 kommentar(er)
