Countdown to Ruin: Hacked Data Goes Public in As Little as Nine Minutes

How quickly do you think you can cancel your credit card in the event of a hack? In the time it takes you to reach the automated number and enter the right sequence of numbers and options, it may be too late.

Image: Max Pixel

According to a new alert from US-CERT (the Computer Emergency Readiness Team of the U.S Department of Homeland Security), nine minutes is all it takes for your compromised personal information to be widely accessible and for sale to the hacker universe, and for criminals to start trying to use your stolen information. If that information includes usernames and passwords that you use for multiple sites, are you confident that you could change the passwords to all those sites in under nine minutes? Chances are, you won’t even know your information has been hacked in the first nine minutes following the hack.

Your personal information, once hacked, is typically posted online in hacker forums and paste sites such as Pastebin. There, the data is quickly accessed by other criminals in as little as nine minutes, according to FTC researchers who conducted an experiment to track attempts to use stolen information.

Your account information by itself may be worth as little as $2, but it may be very valuable to criminals who can exploit the stolen information while it is still valid. And your information might be packaged with other compromised information in baskets of stolen data for sale – like an Amazon or eBay for hacked data – but accessible to criminals using specialized browsers such as Tor.

To mitigate the risk of identity theft, the FTC recommends using multi-factor authentication where feasible. Passwords are a typical form of single-factor authentication. Multi-factor authentication requires one or more additional pieces of information, such as a PIN or one-time code, to verify your identity. This also makes it more difficult for someone who has stolen your username and password to monetize or use that information effectively – because they do not have all the necessary pieces to be able to get into your account.


Subscribe to CSS Blog

CSS frequently publishes blog posts which are written by our team from their observations in the field, at conferences and through experiences with compliance professionals. These posts are designed to further knowledge and share industry best practices. Topics run the gamut, including Form ADV, cybersecurity, MiFID II, position limit monitoring, technology challenges and more. Complete and submit the brief form below to receive notifications when we publish new content.

Loading form...

Latest Content

Countdown to CCPA: Are You Ready to Comply with New Data Privacy Requirements?

With less than one month before the California Consumer Privacy Act (CCPA) is effective, companies are preparing to update their cybersecurity programs. Many must address the regulation’s new data privacy requirements, which have caught some financial institutions off guard. Modeled to some extent after the European Union’s General Data Protection Regulation (GDPR), the CCPA provides … Continued

ESMA Updates AIFMD Q&A on Reporting to National Competent Authorities

The European Securities and Markets Authority (ESMA) has updated its Questions and Answers on the Alternative Investment Fund Managers Directive (AIFMD). One new Q&A has been added with regard to reporting to National Competent Authorities. ESMA has provided clarification on reporting on liquidity stress tests for closed-ended unleveraged Alternative Investment Funds (AIFs). These AIFs are exempt from the … Continued

CSS Named to RegTech 100 List of World’s Most Innovative RegTech Companies

NEW YORK – Compliance Solutions Strategies (CSS) is proud to announce its inclusion in the RegTech 100 for 2020, a list recognizing the world’s most innovative RegTech companies compiled by RegTech Analyst, a specialist research firm. “We are honored to be selected as one of the most innovative companies within such a competitive and evolving … Continued