Countdown to Ruin: Hacked Data Goes Public in As Little as Nine Minutes

How quickly do you think you can cancel your credit card in the event of a hack? In the time it takes you to reach the automated number and enter the right sequence of numbers and options, it may be too late.

Image: Max Pixel

According to a new alert from US-CERT (the Computer Emergency Readiness Team of the U.S Department of Homeland Security), nine minutes is all it takes for your compromised personal information to be widely accessible and for sale to the hacker universe, and for criminals to start trying to use your stolen information. If that information includes usernames and passwords that you use for multiple sites, are you confident that you could change the passwords to all those sites in under nine minutes? Chances are, you won’t even know your information has been hacked in the first nine minutes following the hack.

Your personal information, once hacked, is typically posted online in hacker forums and paste sites such as Pastebin. There, the data is quickly accessed by other criminals in as little as nine minutes, according to FTC researchers who conducted an experiment to track attempts to use stolen information.

Your account information by itself may be worth as little as $2, but it may be very valuable to criminals who can exploit the stolen information while it is still valid. And your information might be packaged with other compromised information in baskets of stolen data for sale – like an Amazon or eBay for hacked data – but accessible to criminals using specialized browsers such as Tor.

To mitigate the risk of identity theft, the FTC recommends using multi-factor authentication where feasible. Passwords are a typical form of single-factor authentication. Multi-factor authentication requires one or more additional pieces of information, such as a PIN or one-time code, to verify your identity. This also makes it more difficult for someone who has stolen your username and password to monetize or use that information effectively – because they do not have all the necessary pieces to be able to get into your account.


Subscribe to CSS Blog

CSS frequently publishes blog posts which are written by our team from their observations in the field, at conferences and through experiences with compliance professionals. These posts are designed to further knowledge and share industry best practices. Topics run the gamut, including Form ADV, cybersecurity, MiFID II, position limit monitoring, technology challenges and more. Complete and submit the brief form below to receive notifications when we publish new content.

Latest Content

Texas Outlaws and a Silver Bullet: Position Limits in the USA

In this first installment on position limits, Regulatory Guidance expert Greg Hotaling surveys the current landscape of position limits imposed for U.S.-listed commodity derivative holdings, which can affect investment firms and other speculative investors regardless of where they are based. Stay tuned for coverage of EU position limits in the next edition. “Who shot J.R.?!” … Continued

FAQs From the Cyber Desk

Cybersecurity is a fast-moving target, so it is not uncommon for firms to have questions when it comes to assessing and understanding their cybersecurity risks. Here at CSS we receive a lot of cybersecurity questions, so we thought we would take the time to answer 10 of the most common Frequently Asked Questions. (1) What … Continued

EU Position Limits: Born in the USA?

This is the second installment of Regulatory Guidance Expert Greg Hotaling’s blog on position limits, this time addressing EU-listed commodity derivatives and related products.  As always, keep in mind that these limits can apply to asset managers, and other market participants, regardless of where they are based. In 2009, the European Union’s first comprehensive position … Continued