Countdown to Ruin: Hacked Data Goes Public in As Little as Nine Minutes

How quickly do you think you can cancel your credit card in the event of a hack? In the time it takes you to reach the automated number and enter the right sequence of numbers and options, it may be too late.

Image: Max Pixel

According to a new alert from US-CERT (the Computer Emergency Readiness Team of the U.S Department of Homeland Security), nine minutes is all it takes for your compromised personal information to be widely accessible and for sale to the hacker universe, and for criminals to start trying to use your stolen information. If that information includes usernames and passwords that you use for multiple sites, are you confident that you could change the passwords to all those sites in under nine minutes? Chances are, you won’t even know your information has been hacked in the first nine minutes following the hack.

Your personal information, once hacked, is typically posted online in hacker forums and paste sites such as Pastebin. There, the data is quickly accessed by other criminals in as little as nine minutes, according to FTC researchers who conducted an experiment to track attempts to use stolen information.

Your account information by itself may be worth as little as $2, but it may be very valuable to criminals who can exploit the stolen information while it is still valid. And your information might be packaged with other compromised information in baskets of stolen data for sale – like an Amazon or eBay for hacked data – but accessible to criminals using specialized browsers such as Tor.

To mitigate the risk of identity theft, the FTC recommends using multi-factor authentication where feasible. Passwords are a typical form of single-factor authentication. Multi-factor authentication requires one or more additional pieces of information, such as a PIN or one-time code, to verify your identity. This also makes it more difficult for someone who has stolen your username and password to monetize or use that information effectively – because they do not have all the necessary pieces to be able to get into your account.


Subscribe to CSS Blog

CSS frequently publishes blog posts which are written by our team from their observations in the field, at conferences and through experiences with compliance professionals. These posts are designed to further knowledge and share industry best practices. Topics run the gamut, including Form ADV, cybersecurity, MiFID II, position limit monitoring, technology challenges and more. Complete and submit the brief form below to receive notifications when we publish new content.

Loading form...

Latest Content

Takeaways from FINRA’s Examination Priorities 2020

The much-anticipated release of the Financial Industry Regulatory Authority, Inc. (“FINRA”) 2020 Risk Monitoring and Examination Priorities Letter occurred on January 9, 2020. Why is this annual release so important to broker-dealers? In short, it serves as a roadmap to identify compliance and supervisory topics that will underpin FINRA’s examination program as 2020 unfolds. After … Continued

10 Compliance Tips for Starting 2020 Off on the Right Foot

No rest for the weary. With the new year upon us, our attention turns to new budgets, change and planning. With renewed energy as we roll into January thaw, we worry if our compliance program is ready. To give you a leg up, here are 10 tips for investment adviser and broker-dealer compliance teams for … Continued

Compliance Lessons Learned in 2019

Now that we are in mid-January, a few things are evident. We have likely broken one or more New Year’s resolutions, the effect of any rest over the holidays has worn off and we need to complete our annual compliance reviews for 2019 and firm up our 2020 plans. While I don’t have solid advice … Continued