2018 Credential Spill Report Released

2.3 Billion credentials from 51 organizations were reported spilled last year. 

• The number and frequency of spills has remained consistent with the year prior, indicating credential spills (and credential stuffing) continue to be a problem. 

It took, on average, 15 months for credential spills to be discovered and reported. 

• This is the most dangerous window of time as criminals carry out credential stuffing attacks using credentials that have not yet been identified as compromised, meaning companies have no way of knowing which users are at risk.
• IF AN AVERAGE 15 MONTH ACCOUNT TAKEOVER (ATO) EXPOSURE WINDOW OF COMPROMISED CREDENTIALS IS TOO MUCH RISK, TAKE A LOOK AT BLACKFISH. ("Blackfish informs when stolen credentials are first used.")

Consumer banking as an industry faces the highest potential losses from credential stuffing ($46M/day), while retail faces the highest actual losses ($16M/day). 

• Potential losses refers to the losses that would be incurred if none of the ATO fraud was caught by fraud detection mechanisms. Banking industry has more fraud resources and tolerance for user friction, so they are able to detect and prevent more fraud than the retail industry.

2018 Credential Spill Report (of 2017)

#CredentialStuffing #AccountTakeover #ATO #DataExfiltration #Fraud #BotMitigation #BotManagement #StopATO