Covers how cybercriminals gain unauthorized access to user accounts through credential theft, phishing, and brute-force attacks. Provides detection strategies, prevention techniques, and recovery steps for individuals and organizations facing account takeover threats.
posts
23andMe Lost 6.9 Million Records to a Credential Stuffing Attack In October 2023, genetic testing company 23andMe confirmed that threat actors had compromised roughly 14,000 accounts using stolen credentials from other breaches. Because of the platform's social sharing features, that initial foothold gave attackers access to
In February 2022, a teenage hacker tricked a T-Mobile employee into performing a SIM swap, then used that hijacked phone number to intercept SMS verification codes and breach Lapsus$ targets including Nvidia and Microsoft. The attack wasn't sophisticated. It didn't require zero-day exploits. The threat actor
23 Billion Stolen Credentials Are Circulating Right Now In 2020, Digital Shadows found more than 15 billion stolen credentials for sale on dark web markets — and that number has only climbed since. Every single one of those username-password pairs is ammunition for a credential stuffing attack. This isn't
In January 2024, Roku disclosed that a credential stuffing attack compromised roughly 591,000 user accounts across two separate incidents. Attackers didn't hack Roku's servers. They simply took username-and-password pairs leaked from other breaches and tried them at scale. It worked because hundreds of thousands of
Your Old AIM Email Address Is Still a Liability In December 2017, AOL officially shut down AIM — AOL Instant Messenger — ending a 20-year run that defined how an entire generation communicated online. But here's what most people don't realize: the credentials tied to AIM email accounts
