After the breach: Change your password, quickly

Introduction

When you hear the news that a company of which you’re a customer has suffered a data breach, your first thought is likely to be whether your personal information is in the hands of hackers. The breach story will often give you an insight into what data wasn’t or was compromised, with online account passwords being one of the usual suspects. The next legitimate question to come to mind: Should I change my password?

If you think your online account has any value, then changing your password is the right first step. Why? Because there’s a chance that bad actors have taken over your account and are posing as the legitimate owner — draining funds, accessing sensitive personal data, and even creating a new account. Plus, if you reuse the password of your compromised account for another account with another company, adversaries can use basic social engineering to hack both of your accounts. As such, it makes good sense to change your password, and you’d likely receive a data breach notification from the company. 

Two year's worth of NIST-aligned training

Deliver a comprehensive security awareness program using this series' 1- or 2-year program plans.

Book a Demo

But are these notifications effective at getting people to take changing a password seriously?

Password-related data breach notifications and their impact

Many companies that have been a victim of a data breach (eBay and Sony, for example) have this policy of issuing breach-related notifications to their customers. These announcements often highlight the cause of the breach and advice users to change their passwords following an adverse event. But these messages aren’t as effective at inspiring password change as the companies issuing them think. 

In a study presented at the IEEE 2020 Workshop on Technology and Consumer Protection, researchers from Carnegie Mellon University found that only one-third of people change their passwords following a data breach announcement. Interestingly, the finding isn’t based on survey data collected from participants, but on browser histories willingly shared for the research. 

Researchers tracked and analyzed the online activities of 249 people who signed up with Carnegie Mellon’s SBO (Security Behavior Observatory) unit to share their browser history. Some of the volunteers were victims of data breaches that occurred between January 2017 and December 2018 (including breaches impacting Yahoo and Deloitte). The research team used the data to investigate not only web traffic but also passwords stored inside the browsers and used to log into websites.

Based on their analysis, the researchers revealed that 63 of the 249 voluntary participants were affected by the breach. But what’s disheartening is the finding that only 21 (33 percent) of the victims changed their password after the data breach announcement. Worse, most of the new passwords were similar to the ones these victims had on other accounts. They were so similar that a simple brute-force attack would provide hackers with access to those accounts.

What’s more, 6 of 21 people who changed their password after a breach took longer than three months to do so. Plus, only 9 of the 21 victims successfully created a stronger password, based on their password’s log10-transformed strength. The rest came up with passwords of similar or weaker strength, usually by using character sequences that were similar to other passwords stored in their browser.

Overall, the outcomes indicate that password breach notifications are failing at causing people to take appropriate action. 

From a preventive standpoint, researchers conclude that companies issuing breach notifications detail the risks of password reuse, offer actionable instructions on how to create strong passwords, and strongly recommend users that they change their passwords beyond the breached account. They also say that regulators could encourage companies to use alternative methods of authentication, such as 2FA (two-factor authentication. Lastly, companies can be made to send repeat notifications until they get word that the message has been understood and users have implemented the advice.

Conclusion: Stay ahead of adversaries by changing your passwords regularly

While it’s a good idea to change your password quickly after a breach, you can make life difficult for hackers by making regular password changes. Taking this step ensures that even if someone manages to get hold of your online account credentials, they won’t be able to leverage them forever. How often should you change your password depends on how critical your online accounts are.

Passwords for accounts linked with sensitive data like your social security code should be updated more often than others. We recommend that you should change these account passwords every 90 days. Passwords for less important accounts can wait a little longer, but you should still change them every 180 days. However, these timelines apply if you’re using a password manager that automatically creates hard-to-crack passwords. If you’re relying on yourself to choose a strong password, passwords may need to be changed more frequently. 

Additionally, we suggest using two-factor authentication for your most important accounts, like email and online banking. This adds an additional layer of security by requesting a second verification that you are the legitimate owner of an account. With 2FA activated, the company with which you have an account will send you a code on your email or phone to verify your identity. Therefore, even if a hacker manages to get hold of your password, they won’t be able to log into your account unless they have one of your devices.

By implementing these practices and educating yourself the dangers of reusing passwords and weak passwords, you’ll go a long way toward safeguarding your personal information.

See Infosec IQ in action

From gamified security awareness to award-winning training, phishing simulations, culture assessments and more, we want to show you what makes Infosec IQ an industry leader.

Demo Now

Sources

1. Sruti Bhagavatula, Lujo Bauer, Apu Kapadia, "(How) Do People Change Their Passwords After a Breach?"
2. Why changing passwords isn't the answer to a data breach, Information Age
3. 5 common password mistakes you should avoid, WeLiveSecurity