Module 1 · 1.4

English

Nederlands English Deutsch

Account takeover and data breaches

Module 1: Why you're a target · Reading time: 10 minutes

Learning objective: After this lesson, you can explain how stolen login details are reused and what happens to leaked data.
Key concepts: account takeover, credential stuffing, infostealer, session cookie, data breach, personal data, combo list

Logging in instead of breaking in

The easiest way into a system isn't finding a vulnerability, it's simply logging in. Anyone who has your email address and password doesn't need to hack anything. As far as the system is concerned, they are you. This is called an account takeover: someone else takes over an account and uses it as if they were the owner.

For a small business, the mailbox is the most important account. Whoever has your mailbox can:

use "forgot password" to reset the passwords of almost all your other accounts;
read your mail and send a fake invoice at exactly the right moment (lesson 1.2);
send mail to customers on your behalf, who trust you;
set up a forwarding rule, so they keep receiving a copy of all your mail unnoticed, even after you've changed your password (lesson 2.5).

But how does an attacker get hold of your password? There are three main routes: you enter it yourself on a fake site (phishing, module 3), it leaks from another service where you also used it, or malicious software on your computer steals it. We'll cover the last two here.

Credential stuffing: one leak, tried everywhere

Websites get hacked regularly. Such a leak often exposes users' email addresses and passwords, sometimes readable, sometimes in a form that can be cracked with computing power. This data is collected, combined and traded in enormous lists of email addresses with passwords: combo lists.

With such a list, an attacker performs credential stuffing: they automatically try every email address and password pair on other services. OWASP, a well known open organisation for web security, describes it as the automated injection of stolen credentials to gain access to accounts. It works for one reason: people use the same password in multiple places.

An example. Petra from Bakkerij Example created an account years ago with a webshop for baking supplies, using info@example.com and the password she used everywhere at the time. That webshop gets hacked. A year later, her combination ends up in a combo list. A programme tries it overnight on:

Service	Same password?	Result
Webmail for `example.com`	Yes	In
`boekhoudpakket.example`	Yes	In
Bakery's social media	No, different password	Fail
`mijnbank.example`	Yes, but two-factor authentication on	Failed at the second step

Petra notices nothing: she hasn't seen a phishing email and hasn't clicked anything. The lessons from this: a unique password per service prevents one leak from spreading (lessons 2.1 and 2.2), and two-factor authentication stops an attacker who does have the right password (lesson 2.3). You can check for yourself at https://haveibeenpwned.com whether your email address appears in a known breach.

A common mistake is a "system" for varying passwords: Bakkerij2025! for mail and Bakkerij2025!boekhouding for the accounts. Programmes using combo lists also try such obvious variations.

Infostealers: the password straight from your computer

An infostealer is malicious software that collects data from your computer and sends it to the attacker. Microsoft describes infostealers as harvesting, among other things, stored usernames and passwords, session cookies, autofilled form data and credit card details from browsers. You might get such a programme through a fake download ("free version of an expensive programme"), an attachment, a fake advert, or a site that asks you to copy and paste a command "to fix a problem".

An infostealer often works within a few minutes and then disappears again. The haul, a so-called log with all the data from that one computer, is sold. Sometimes it's used years later.

Why a session cookie is so dangerous

When you log in to a website, with a password and two-factor authentication, your browser receives a session cookie: a small file that shows with every subsequent request that you're already logged in. That's why you don't need to enter your code again with every click.

Whoever steals that cookie can put it in their own browser and is then also logged in. They don't need your password or your second factor, because the login has already happened. MITRE ATT&CK, a public knowledge base of attack techniques, says it literally: session cookies can be used to bypass some forms of multi-factor authentication.

What helps against infostealers and stolen cookies:

don't install software from unknown sources, and don't work with an administrator account, so installing isn't simply possible (lesson 5.2);
keep your operating system and browser updated (lesson 5.1);
after an infection, first clean the computer or reinstall it, then change passwords from a clean device and revoke all sessions, so stolen cookies become invalid (lessons 2.5 and 3.5);
phishing resistant login methods such as passkeys, which make it impossible to steal login details via fake sites (lesson 2.4).

What a data breach is

So far this has been about your own accounts. But if an attacker is in your mailbox, your accounts or your webshop, they also see other people's data: customers, employees, members. That's when there's a data breach.

The GDPR defines personal data as all information about an identified or identifiable person: a name, an email address, a phone number, an address, but also a customer number that can be linked to a person. A data breach (in the GDPR: a personal data breach, Article 4(12)) is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.

A data breach doesn't have to be a hack. The following can also be a data breach:

an email with a customer list sent to the wrong recipient;
a stolen or lost laptop without encryption;
a share link to a folder of CVs that's publicly accessible on the internet;
a taken over mailbox containing invoices with names and addresses;
files encrypted by ransomware for which you have no backup (destruction and loss).

A data breach comes with obligations: you record every data breach in a data breach register, you report it within 72 hours to the relevant data protection authority unless it's unlikely to pose a risk to those involved, and in case of a high risk you also inform the people themselves. You'll learn exactly how this works in lesson 8.2. For now, the important thing is not to see an account takeover only as "our problem": it often also affects the people whose data you hold.

What happens to leaked data

Leaked data doesn't disappear. It gets copied, combined and resold. That means a leak has consequences that last a long time:

Reuse: passwords end up in combo lists for credential stuffing.
Better phishing: with your name, your customers and your latest order, a scammer crafts a convincing email. A customer who receives a "payment reminder" from you the week after a leak at your webshop pays faster.
Identity fraud: with enough data about a person, a scammer can open accounts or impersonate that person.
Extortion: "pay, or we'll tell your customers their data was leaked by you" (lesson 1.3).

That's why keeping less data is also a security measure. Data you don't hold can't leak either.

Summary

In an account takeover, an attacker simply logs in; the mailbox is the most important account, because you use it to recover other passwords.
Credential stuffing automatically tries leaked email address and password combinations from combo lists on other services; unique passwords and 2FA stop it.
Infostealers steal passwords and session cookies from the browser; with a stolen cookie an attacker can bypass some 2FA, so revoke all sessions after an infection.
A data breach is any breach of the security of personal data, including a wrongly sent email or a lost laptop.
Leaked data is reused for new attacks; keeping less data means less risk.

Quiz

Exercise

Exercise A1.4: One leak, which accounts are at risk? You're given an overview of a small business's accounts: which password (labelled W1, W2 and so on, never a real password) belongs to which service, and whether two-factor authentication is on. Then one service leaks. Indicate which accounts are immediately at risk, in what order you'll address them, and whether there's a data breach. The programme checks your answers and explains them.

Cookies at WebOké

Cookie settings

Necessary

Marketing