The Yahoo data breach which has affected an estimated 1 Billion Yahoo email users, could ultimately affect more than 10bn internet users – even if they are not Yahoo users, claims UK based risk management specialists, RiskCentric.
Managing Partner, Steve Dance explains: “The breach has allowed the hackers to access the personal information of, we are told, over 1 billion Yahoo email accounts. That means that the hackers know a lot more than user names and email addresses of Yahoo customers– they also have access to their ‘digital relationships’ such as the email addresses of friends, family and internet retailers. In other words they know who you know and who you buy things from. If, for every account compromised, the hackers have managed to obtain 10 unique email addresses, 10 billion internet users will be at risk from email phishing attacks”.
This article was written by Steve Dance who is the Managing Partner of RiskCentric
RiskCentric provide automated management systems, education and awareness management solutions for business continuity, cyber security, regulatory and standards compliance
The implications are significant for every internet user and RiskCentric are predicting that many people, whether they are Yahoo users or not, will be at risk from email phishing attacks based on information stolen from Yahoo accounts. Some possible scenario s are:
– Yahoo users whose accounts have been compromised may receive emails from people they are “familiar” with. – except that these emails will actually come from hackers who have “spoofed” a familiar email address
– Internet users may receive emails from Yahoo email accounts that look familiar but these, too will have been sent from a “spoofed” a email address
– “Special offers” may be received from online retailers that the account holder has previously purchased goods from. The email address will look authentic, but again the email – although having an address that looks like it’s from the retailer – will be from a hacker, looking to trick the user into clicking malicious links in the email
– A combination of the above where an email appears to have been forwarded by a familiar contact with a “thought you might be interested in this” message. Of course, the forwarding email is phony and any links in the message are malicious.
Defending against these kinds of attacks relies on vigilance and awareness, Dance says:
The genie is now out of the bottle and all users need to be really vigilant with email usage. Because of the nature of the compromise, hackers now have the tools to create highly sophisticated phishing attacks because they know something of your digital relationships.” He suggests that individuals should be wary if the tone and context of emails received from personal contacts looks “odd” or contains content that looks unusual (would this person send you an attachment, for instance). As regards messages from online retailers, these too should be viewed with caution, the advice here is not to click on links, but go direct to the retailers site via a browser and login as usual.